|2016-07-07||HMI||LeviStudio||Rocco Calvi, Brian Gorenc||N/A||2016-4533, 2016-5781||N/A||N/A||N/A|
# WECON LeviStudio Buffer Overflow Vulnerabilities
Independent security researchers Rocco Calvi and Brian Gorenc, working with Trend Micro’s Zero Day Initiative, have identified buffer overflow vulnerabilities in WECON’s LeviStudio software. WECON has not released a product fix to addresses the buffer overflow vulnerabilities in the LeviStudio software.
### AFFECTED PRODUCTS
The following LeviStudio versions are affected:
LeviStudio, all versions.
Successful exploitation of these vulnerabilities may allow remote code execution.
Impact to individual organizations depends on many factors that are unique to each organization. NCCIC/ICS-CERT recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation.
WECON is a China-based company.
The affected product, LeviStudio, is an HMI programming software. According to WECON, LeviStudio is deployed across several sectors including Chemical, Critical Manufacturing, and Energy. WECON estimates that this product is primarily used in Asia.
### VULNERABILITY CHARACTERIZATION
# VULNERABILITY OVERVIEW
HEAP-BASED BUFFER OVERFLOW
Specific flaws in the handling of some files may allow an attacker to cause a heap-based buffer overflow and execute code in the context of the running process.
CVE-2016-4533 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).
STACK-BASED BUFFER OVERFLOW
Specific flaws in the handling of some files may allow an attacker to cause a stack-based buffer overflow and execute code in the context of the running process.
CVE-2016-5781 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).
### VULNERABILITY DETAILS
These vulnerabilities are not exploitable remotely and cannot be exploited without user interaction. The exploit is only triggered when a local user runs the vulnerable application and loads the malformed file or visits a malicious web site.
# EXISTENCE OF EXPLOIT
No known public exploits specifically target these vulnerabilities.
An attacker with low skill would be able to exploit these vulnerabilities. Crafting a working exploit for these vulnerabilities would not be difficult; however, social engineering is required to convince the user to accept the malformed file or visit a malicious web site. This decreases the likelihood of a successful exploit.
WECON has not released a product fix to address the buffer overflow vulnerabilities in the LeviStudio software. WECON has indicated that they are planning to release a product fix; however, a definitive release date has not been established.