Stack-based buffer overflow in OPTO 22 PAC Project Professional
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.
Summary
A vulnerable file in Opto 22 PAC Project Professional versions prior to R9.4006, PAC Project Basic versions prior to R9.4006, PAC Display Basic versions prior to R9.4f, PAC Display Professional versions prior to R9.4f, OptoOPCServer versions prior to R9.4c, and OptoDataLink version R9.4d and prior versions that were installed by PAC Project installer, versions prior to R9.4006, is susceptible to a heap-based buffer overflow condition that may allow remote code execution on the target system. Opto 22 suggests upgrading to the new product version as soon as possible.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OPTO 22 | PAC Project Professional | < R9.4006 | — | No fix listed | CNA |
| OPTO 22 | PAC Project Basic | < R9.4006 | — | No fix listed | CNA |
| OPTO 22 | PAC Display Basic | < R9.4f | — | No fix listed | CNA |
| OPTO 22 | PAC Display Professional | < R9.4f | — | No fix listed | CNA |
| OPTO 22 | OptoOPCServer | < R9.4c | — | No fix listed | CNA |
| OPTO 22 | OptoDataLink | R9.4d and prior that were installed by PAC Project installer; versions prior to R9.4006 | — | No fix listed | CNA |
- PAC Project Professional VendorOPTO 22 Affected < R9.4006 Fixed in — No fix listed CNA
- PAC Project Basic VendorOPTO 22 Affected < R9.4006 Fixed in — No fix listed CNA
- PAC Display Basic VendorOPTO 22 Affected < R9.4f Fixed in — No fix listed CNA
- PAC Display Professional VendorOPTO 22 Affected < R9.4f Fixed in — No fix listed CNA
- OptoOPCServer VendorOPTO 22 Affected < R9.4c Fixed in — No fix listed CNA
- OptoDataLink VendorOPTO 22 Affected R9.4d and prior that were installed by PAC Project installer; versions prior to R9.4006 Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:opto22:optodatalink:*:*:*:*:*:*:*:* | before r9.4d | Vulnerable | OPTO 22 |
| cpe:2.3:a:opto22:optoopcserver:*:*:*:*:*:*:*:* | before r9.4c | Vulnerable | OPTO 22 |
| cpe:2.3:a:opto22:pac_display:*:*:*:*:basic:*:*:* | before r9.4f | Vulnerable | OPTO 22 |
| cpe:2.3:a:opto22:pac_display:*:*:*:*:professional:*:*:* | before r9.4f | Vulnerable | OPTO 22 |
| cpe:2.3:a:opto22:pac_project:*:*:*:*:basic:*:*:* | before r9.4006 | Vulnerable | OPTO 22 |
| cpe:2.3:a:opto22:pac_project:*:*:*:*:professional:*:*:* | before r9.4006 | Vulnerable | OPTO 22 |
- cpe:2.3:a:opto22:optodatalink:*:*:*:*:*:*:*:* Versions before r9.4d Vulnerable ·OPTO 22
- cpe:2.3:a:opto22:optoopcserver:*:*:*:*:*:*:*:* Versions before r9.4c Vulnerable ·OPTO 22
- cpe:2.3:a:opto22:pac_display:*:*:*:*:basic:*:*:* Versions before r9.4f Vulnerable ·OPTO 22
- cpe:2.3:a:opto22:pac_display:*:*:*:*:professional:*:*:* Versions before r9.4f Vulnerable ·OPTO 22
- cpe:2.3:a:opto22:pac_project:*:*:*:*:basic:*:*:* Versions before r9.4006 Vulnerable ·OPTO 22
- cpe:2.3:a:opto22:pac_project:*:*:*:*:professional:*:*:* Versions before r9.4006 Vulnerable ·OPTO 22
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2015-1006
- 2026-10-03 Alias added: GHSA-qcrp-fp63-2c3q
References
More OPTO 22 Optodatalink vulnerabilities
- TI-2015-00919 Stack-based buffer overflow in OPTO 22 PAC Project Professional CVSS 3.0HIGH 7.8
Sources
- CVE-2015-1006 · CVE Program
- CVE-2015-1006 · NVD
- FIRST EPSS
- GHSA-qcrp-fp63-2c3q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences