A specially crafted configuration file could be used to cause a stack-based buffer overflow condition in the OPCTest.exe, which may allow re
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in R9.4008, R9.4g
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
A specially crafted configuration file could be used to cause a stack-based buffer overflow condition in the OPCTest.exe, which may allow remote code execution on Opto 22 PAC Project Professional versions prior to R9.4008, PAC Project Basic versions prior to R9.4008, PAC Display Basic versions prior to R9.4g, PAC Display Professional versions prior to R9.4g, OptoOPCServer version R9.4c and prior that were installed by PAC Project installer, versions prior to R9.4008, and OptoDataLink version R9.4d and prior that were installed by PAC Project installer, versions prior to R9.4008. Opto 22 suggests upgrading to the new product version as soon as possible.
Timeline
- CVE published
- Record last updated
Affected versions
- Opto 22 PAC Project Professional
fixed in R9.4008
- Opto 22 PAC Project Basic
fixed in R9.4008
- Opto 22 PAC Display Basic
fixed in R9.4g
- Opto 22 PAC Display Professional
fixed in R9.4g
- Opto 22 OptoOPCServer
Version range not reported
- Opto 22 OptoDataLink
Version range not reported