Kostac PLC Programming Software Vulnerable to Stack-Based Buffer Overflow and DoS Attacks
CVE-2024-47135

7.8HIGH

Key Information:

Vendor

Jtekt Electronics Corporation

Status
Kostac Plc Programming Software (former Name: Koyo Plc Programming Software)
Vendor
CVE Published:
3 October 2024

What is CVE-2024-47135?

A stack-based buffer overflow vulnerability has been identified in the Kostac PLC Programming Software, formerly known as Koyo PLC Programming Software. This issue affects Version 1.6.14.0 and earlier versions and stems from improper parsing of KPP project files saved using Version 1.6.9.0 and earlier. A maliciously crafted project file can trigger this vulnerability when opened by an unsuspecting user, potentially leading to a denial-of-service condition, arbitrary code execution, and leakage of sensitive information.

Affected Version(s)

Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) 1.6.14.0 and earlier

References

https://www.electronics.jtekt.co.jp/en/topics/202410026928/
https://www.electronics.jtekt.co.jp/jp/topics/2024100217388/
https://jvn.jp/en/vu/JVNVU92808077/

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.