Stack-based buffer overflow in OPTO 22 PAC Project Professional
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.
Summary
A specially crafted configuration file could be used to cause a stack-based buffer overflow condition in the OPCTest.exe, which may allow remote code execution on Opto 22 PAC Project Professional versions prior to R9.4008, PAC Project Basic versions prior to R9.4008, PAC Display Basic versions prior to R9.4g, PAC Display Professional versions prior to R9.4g, OptoOPCServer version R9.4c and prior that were installed by PAC Project installer, versions prior to R9.4008, and OptoDataLink version R9.4d and prior that were installed by PAC Project installer, versions prior to R9.4008. Opto 22 suggests upgrading to the new product version as soon as possible.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OPTO 22 | PAC Project Professional | < R9.4008 | — | No fix listed | CNA |
| OPTO 22 | PAC Project Basic | < R9.4008 | — | No fix listed | CNA |
| OPTO 22 | PAC Display Basic | < R9.4g | — | No fix listed | CNA |
| OPTO 22 | PAC Display Professional | < R9.4g | — | No fix listed | CNA |
| OPTO 22 | OptoOPCServer | R9.4c and prior that were installed by PAC Project installer versions prior to R9.4008 | — | No fix listed | CNA |
| OPTO 22 | OptoDataLink | R9.4d and prior that were installed by PAC Project installer versions prior to R9.4008 | — | No fix listed | CNA |
- PAC Project Professional VendorOPTO 22 Affected < R9.4008 Fixed in — No fix listed CNA
- PAC Project Basic VendorOPTO 22 Affected < R9.4008 Fixed in — No fix listed CNA
- PAC Display Basic VendorOPTO 22 Affected < R9.4g Fixed in — No fix listed CNA
- PAC Display Professional VendorOPTO 22 Affected < R9.4g Fixed in — No fix listed CNA
- OptoOPCServer VendorOPTO 22 Affected R9.4c and prior that were installed by PAC Project installer versions prior to R9.4008 Fixed in — No fix listed CNA
- OptoDataLink VendorOPTO 22 Affected R9.4d and prior that were installed by PAC Project installer versions prior to R9.4008 Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:opto22:optodatalink:*:*:*:*:*:*:*:* | up to r9.4d | Vulnerable | OPTO 22 |
| cpe:2.3:a:opto22:optoopcserver:*:*:*:*:*:*:*:* | up to r9.4c | Vulnerable | OPTO 22 |
| cpe:2.3:a:opto22:pac_display:*:*:*:*:basic:*:*:* | before r9.4g | Vulnerable | OPTO 22 |
| cpe:2.3:a:opto22:pac_display:*:*:*:*:professional:*:*:* | before r9.4g | Vulnerable | OPTO 22 |
| cpe:2.3:a:opto22:pac_project:*:*:*:*:basic:*:*:* | before r9.4008 | Vulnerable | OPTO 22 |
| cpe:2.3:a:opto22:pac_project:*:*:*:*:professional:*:*:* | before r9.4008 | Vulnerable | OPTO 22 |
- cpe:2.3:a:opto22:optodatalink:*:*:*:*:*:*:*:* Versions up to r9.4d Vulnerable ·OPTO 22
- cpe:2.3:a:opto22:optoopcserver:*:*:*:*:*:*:*:* Versions up to r9.4c Vulnerable ·OPTO 22
- cpe:2.3:a:opto22:pac_display:*:*:*:*:basic:*:*:* Versions before r9.4g Vulnerable ·OPTO 22
- cpe:2.3:a:opto22:pac_display:*:*:*:*:professional:*:*:* Versions before r9.4g Vulnerable ·OPTO 22
- cpe:2.3:a:opto22:pac_project:*:*:*:*:basic:*:*:* Versions before r9.4008 Vulnerable ·OPTO 22
- cpe:2.3:a:opto22:pac_project:*:*:*:*:professional:*:*:* Versions before r9.4008 Vulnerable ·OPTO 22
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2015-1007
- 2026-10-03 Alias added: GHSA-qg83-5693-xjqm
References
More OPTO 22 Optodatalink vulnerabilities
- TI-2015-00918 Stack-based buffer overflow in OPTO 22 PAC Project Professional CVSS 3.0CRITICAL 9.8
Sources
- CVE-2015-1007 · CVE Program
- CVE-2015-1007 · NVD
- FIRST EPSS
- GHSA-qg83-5693-xjqm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences