CVE-2018-25345
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
A local buffer overflow vulnerability exists in 10-Strike Network Scanner 3.0 in the host name field, allowing attackers to bypass SafeSEH protections and execute arbitrary code. Malicious payloads in the host name or address field trigger the flaw via Trace route or System information functions.
Risk Assessment
An attacker with local access can execute arbitrary code in the application's context, leading to system compromise. This poses risks of privilege escalation and data confidentiality loss.
Recommendation
Update 10-Strike Network Scanner to the latest patched version immediately. Restrict application access to trusted users only.
Original NVD description (English source)
10-Strike Network Scanner 3.0 contains a local buffer overflow vulnerability in the host name field that allows attackers to bypass SafeSEH protections and execute arbitrary code. Attackers can craft a malicious payload in the host name or address field and trigger the vulnerability through the Trace route or System information functions to achieve code execution.