Vulnerability record · CVE-2018-10594 · published 26 June 2018
CVE-2018-10594: Delta COMMGR stack buffer overflow via network packet length
Deltaww · Commgr
Delta Industrial Automation COMMGR versions 1.08 and prior, along with bundled PLC simulators, use a fixed-length stack buffer and read an unverified length value from network packets on a specific port, overwriting the buffer. The flaw can lead to remote code execution, application crash, or denial of service on the application server.
Description
Delta Industrial Automation COMMGR from Delta Electronics versions 1.08 and prior with accompanying PLC Simulators (DVPSimulator EH2, EH3, ES2, SE, SS2 and AHSIM_5x0, AHSIM_5x1) utilize a fixed-length stack buffer where an unverified length value can be read from the network packets via a specific network port, causing the buffer to be overwritten. This may allow remote code execution, cause the application to crash, or result in a denial-of-service condition in the application server.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with network reachability, no authentication, and public exploit code makes this a critical remote code execution and denial-of-service risk.
What it is
Delta Industrial Automation COMMGR versions 1.08 and prior, along with bundled PLC simulators, use a fixed-length stack buffer and read an unverified length value from network packets on a specific port, overwriting the buffer. The flaw can lead to remote code execution, application crash, or denial of service on the application server.
Impact
An unauthenticated remote attacker can overwrite stack memory, potentially executing arbitrary code on the COMMGR server or crashing it to cause denial of service.
Attack surface
Reachable over the network via a specific network port with no authentication or user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N.
Exploitation
Public exploit code exists in Exploit-DB (references 44965 and 45574); the CVE is not listed in CISA KEV, but EPSS is high at roughly 0.686 (99.3rd percentile).
What to do
- Upgrade COMMGR to a version later than 1.08 and update the accompanying PLC simulators per the ICS-CERT advisory ICSA-18-172-01.
- Restrict network access to the COMMGR service port using firewalls or segmentation so only trusted engineering hosts can reach it.
- Do not expose COMMGR or the simulators to untrusted networks or the internet.
- Monitor vendor and ICS-CERT advisories for updated fixed versions and apply them promptly.
Detection
- Monitor for crashes or abnormal termination of COMMGR and PLC simulator processes.
- Inspect network traffic to the COMMGR service port for oversized or malformed length fields in packets.
- Alert on unexpected processes spawned by COMMGR or the simulators, which may indicate code execution.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.securityfocus.com/bid/104529 | Third Party AdvisoryVDB Entry |
| https://ics-cert.us-cert.gov/advisories/ICSA-18-172-01 | Third Party AdvisoryUS Government Resource |
| https://www.exploit-db.com/exploits/44965/ | ExploitThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/45574/ | ExploitThird Party AdvisoryVDB Entry |
| http://www.securityfocus.com/bid/104529 | Third Party AdvisoryVDB Entry |
| https://ics-cert.us-cert.gov/advisories/ICSA-18-172-01 | Third Party AdvisoryUS Government Resource |
| https://www.exploit-db.com/exploits/44965/ | ExploitThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/45574/ | ExploitThird Party AdvisoryVDB Entry |
Track CVE-2018-10594 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2018-10594), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
