CVE-2018-10628

Name: CVE-2018-10628
Creator: NVD / NIST
Published: 2018-07-24T18:29:00.233+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 5.43%

Last modified Jun 17, 2026

CVE-2018-10628 is a vulnerability of currently unknown severity. AVEVA InTouch 2014 R2 SP1 and prior, InTouch 2017, InTouch 2017 Update 1, and InTouch 2017 Update 2 allow an unauthenticated user to send a specially crafted packet that could overflow the buffer on a locale not using a dot floating point separator. Exploitation could allow remote code execution under the privileges of the InTouch View process.. EPSS estimates a 5.43% chance of exploitation in the next 30 days.

Description

AVEVA InTouch 2014 R2 SP1 and prior, InTouch 2017, InTouch 2017 Update 1, and InTouch 2017 Update 2 allow an unauthenticated user to send a specially crafted packet that could overflow the buffer on a locale not using a dot floating point separator. Exploitation could allow remote code execution under the privileges of the InTouch View process.

Metrics

EPSS Probability

5.43%

91.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Aveva	Intouch 2014	r2
Aveva	Intouch 2017	All versions

References

http://www.securityfocus.com/bid/104864Broken Link
https://ics-cert.us-cert.gov/advisories/ICSA-18-200-02Patch, Permissions Required, Third Party Advisory, US Government Resource
https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec127%28003%29.pdf
http://www.securityfocus.com/bid/104864Broken Link
https://ics-cert.us-cert.gov/advisories/ICSA-18-200-02Patch, Permissions Required, Third Party Advisory, US Government Resource
https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec127%28003%29.pdf

Timeline

Published: Jul 24, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2018-10628?

How severe is CVE-2018-10628?

Severity scoring for CVE-2018-10628 is pending analysis. The EPSS model estimates a 5.43% probability of exploitation in the next 30 days.

How do I fix CVE-2018-10628?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2018-10628?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST