CVE-2015-1006

N/A
Published: May 10, 2019 at 01:47 PM UTC
Updated: June 17, 2026 at 12:21 AM UTC
4 products affected across 1 vendorOptoOPCServerOptoDataLinkPac Project

Using PAC Project Professional by Opto 22?

Get instant alerts when new vulnerabilities affect PAC Project Professional - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 5%

Description

A vulnerable file in Opto 22 PAC Project Professional versions prior to R9.4006, PAC Project Basic versions prior to R9.4006, PAC Display Basic versions prior to R9.4f, PAC Display Professional versions prior to R9.4f, OptoOPCServer versions prior to R9.4c, and OptoDataLink version R9.4d and prior versions that were installed by PAC Project installer, versions prior to R9.4006, is susceptible to a heap-based buffer overflow condition that may allow remote code execution on the target system. Opto 22 suggests upgrading to the new product version as soon as possible.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

v ≤ 9.4dv < r9.4dversions prior to R9.4006
Affected range stops below r9.4d, so it looks safe — our inference, not a vendor statement
v < R9.4cv < r9.4c
Affected range stops below r9.4c, so it looks safe — our inference, not a vendor statement
v < R9.4fv < r9.4f
Affected range stops below r9.4f, so it looks safe — our inference, not a vendor statement
v < R9.4006v < r9.4006
Affected range stops below r9.4006, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

References (1)

x_refsource_MISCMitigationThird Party AdvisoryUS Government Resource
https://ics-cert.us-cert.gov/advisories/ICSA-15-120-01

CVSS

Confidentiality
COMPLETE
Integrity
COMPLETE
Availability
COMPLETE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-121CWE-119

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card