CVE:CVE-2018-10620
CNNVD:CNNVD-201807-1550
AVEVA InduSoft Web Studio和InTouch Machine Edition都是英国AVEVA Group plc公司的产品。AVEVA InduSoft Web Studio是一套工控组态软件。InTouch Machine Edition是一套嵌入式HMI软件包。
AVEVA InduSoft Web Studio和InTouch Machine Edition中存在基于栈的缓冲区溢出漏洞。远程攻击者可通过发送特制的数据包利用该漏洞执行代码。以下产品和版本受到影响：AVEVA InduSoft Web Studio 8.1版本和8.1SP1版本；InTouch Machine Edition 2017 8.1版本，2017 8.1 SP1版本。
solution:Upgrade aveva indusoft_web_studio to a higher version than 8.1,8.1:sp1,and avoid the version 8.1,8.1:sp1; Upgrade aveva intouch_machine_2017 to a higher version than 8.1,8.1:sp1,and avoid the version 8.1,8.1:sp1