CVE-2018-17925 : What You Need to Know

A vulnerability named "Unsafe ActiveX Control Marked Safe For Scripting" has been identified in GE iFIX versions 2.0 - 5.8.

Understanding CVE-2018-17925

This CVE involves a vulnerability in a third-party ActiveX component provided to GE iFIX versions 2.0 - 5.8 by Gigasoft.

What is CVE-2018-17925?

The vulnerability affects users who independently use the Gigasoft charting package outside of the iFIX product. It does not impact the main functionality of the iFIX product.

The Impact of CVE-2018-17925

The specific method affecting Internet Explorer is not accessible within the iFIX product, and the core functionality of iFIX is not known to be affected.

Technical Details of CVE-2018-17925

This section provides technical details of the CVE.

Vulnerability Description

Vulnerability: Unsafe ActiveX Control Marked Safe For Scripting CWE-623

Affected Systems and Versions

Product: iFix
Vendor: GE
Versions Affected: 2.0 - 5.0, 5.1, 5.5, 5.8

Exploitation Mechanism

The vulnerability arises from the use of the Gigasoft charting package outside of the iFIX product.

Mitigation and Prevention

Protect your systems from CVE-2018-17925 with the following steps:

Immediate Steps to Take

Avoid independent use of the Gigasoft charting package outside of the iFIX product.
Regularly monitor for security updates and patches.

Long-Term Security Practices

Implement network segmentation to limit the impact of potential attacks.
Educate users on safe browsing practices and the risks of using third-party components.

Patching and Updates

Stay informed about security advisories from GE and Gigasoft.
Apply patches and updates promptly to mitigate the vulnerability.