title: Rockwell Automation Studio 5000 Logix Designer Code Injection
description: Omron CX-Position (versions 2.5.3 and prior) is vulnerable to multiple stack-based buffer overflow conditions while parsing a specific project file, which may allow an attacker to locally execute arbitrary code.
problem types: CWE-121
affected:
{
product: CX-Position
vendor: Omron
versions:
lessThanOrEqual: 2.5.3, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: Omron has provided Version 2.5.4, which is only available to paying users who use the “Auto Update” function. Please contact Omron technical Support or an Omron representative for specific update information.