CVE-2018-17916 Explained : Impact and Mitigation

InduSoft Web Studio versions prior to 8.1 SP2 and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2 are vulnerable to a stack-based buffer overflow exploit that could allow remote attackers to execute unauthorized code.

Understanding CVE-2018-17916

Versions of InduSoft Web Studio and InTouch Edge HMI are susceptible to a critical security flaw that could lead to the execution of arbitrary code by malicious actors.

What is CVE-2018-17916?

The vulnerability is triggered by a remote attacker sending a specially crafted packet during tag, alarm, or event actions like read and write.
Successful exploitation may result in the execution of unauthorized code with the privileges of the affected software.

The Impact of CVE-2018-17916

If remote communication security is not enabled or if a password is blank, a remote user could initiate an arbitrary process, potentially compromising the server machine.

Technical Details of CVE-2018-17916

InduSoft Web Studio and InTouch Edge HMI are affected by a critical vulnerability with the following technical details:

Vulnerability Description

The vulnerability is a stack-based buffer overflow (CWE-121) that allows for remote code execution.

Affected Systems and Versions

InduSoft Web Studio versions prior to 8.1 SP2
InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2

Exploitation Mechanism

Triggered by a remote attacker sending a crafted packet during specific actions like tag, alarm, or event operations.

Mitigation and Prevention

It is crucial to take immediate steps to mitigate the risks posed by CVE-2018-17916:

Immediate Steps to Take

Update InduSoft Web Studio to version 8.1 SP2 or later.
Update InTouch Edge HMI to version 2017 SP2 or later.
Enable remote communication security and ensure passwords are not blank.

Long-Term Security Practices

Regularly monitor for security updates and patches.
Conduct security assessments and penetration testing to identify vulnerabilities.

Patching and Updates

Apply security patches provided by the software vendors to address the vulnerability.