Picajet RoboImport 1.2.0.72 Registration Registration Name/Registration Key buffer overflow

Summaryinfo

A vulnerability was found in Picajet RoboImport 1.2.0.72. It has been rated as critical. This vulnerability affects unknown code of the component Registration Handler. The manipulation of the argument Registration Name/Registration Key leads to buffer overflow. This vulnerability is documented as CVE-2018-25276. The attack needs to be performed locally. Additionally, an exploit exists.

Detailsinfo

A vulnerability was found in Picajet RoboImport 1.2.0.72 and classified as problematic. This issue affects an unknown function of the component Registration Handler. The manipulation of the argument Registration Name/Registration Key with an unknown input leads to a buffer overflow vulnerability. Using CWE to declare the problem leads to CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. Impacted is availability. The summary by CVE is:

RoboImport 1.2.0.72 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input to registration fields. Attackers can paste a 6000-byte buffer into the Registration Name and Registration Key fields and click Register to trigger an application crash.

The weakness was released by Gionathan Reale as 45382. The advisory is shared at exploit-db.com. The identification of this vulnerability is CVE-2018-25276 since 04/26/2026. The exploitation is known to be easy. An attack has to be approached locally. Technical details as well as a public exploit are known.

The exploit is available at exploit-db.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2018-21796). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Picajet

Name

• RoboImport

Version

• 1.2.0.72

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion