CVE-2018-17925

mediumpriority · track · 19EPSS 0.003 · 23 %ileEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.30% (23rd) EPSS

CVSS 4.4 · medium

Is it mine?

13 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · cisa_csaf_ot · nvd

EPSS · scored 2026-10-27

Multiple instances of this vulnerability (Unsafe ActiveX Control Marked Safe For Scripting) have been identified in the third-party ActiveX object provided to GE iFIX versions 2.0 - 5.8 by Gigasoft. Only the independent use of the Gigasoft charting package outside the iFIX product may expose users to the reported vulnerability. The reported method shown to impact Internet Explorer is not exposed in the iFIX product, nor is the core functionality of the iFIX product known to be impacted.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedGigasoft componentscisa_csaf_ot
GE released iFIX 5.9 in June 2017 to address this issue by incorporating Gigasoft Version 8.0
FixediFIXcisa_csaf_ot
GE released iFIX 5.9 in June 2017 to address this issue by incorporating Gigasoft Version 8.0
MitigationGigasoft componentscisa_csaf_ot
GE recommends users only use ActiveX from trusted sources.
MitigationiFIXcisa_csaf_ot
GE recommends users only use ActiveX from trusted sources.

cvss

Technical severity, 0–10. One row per scoring source.

5.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.04.4mediumAV:L/AC:M/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 3.4 · impact 6.4

v3.04.8mediumCVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:Lprimary · NVD / NIST USexploitability 1.3 · impact 3.4

v3.05.3mediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:Lsecondary · CISA US

v3.04.4mediumCVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-623USCWE-623US

affected products (13)

Products and version ranges known to be affected.

Gigasoft components: older than Version 8.0 are likely to be used in other products from other vendors alsoall versionscisa_csaf_otUS
iFIX: 2.0 - 5.0all versionscisa_csaf_otUS
iFIX: 5.1all versionscisa_csaf_otUS
iFIX: 5.5all versionscisa_csaf_otUS
iFIX: 5.8all versionscisa_csaf_otUS
General Electric (GE) Gigasoft components< 8.0cisa_csaf_otUS
General Electric (GE) iFIXall versionscisa_csaf_otUS
General Electric (GE) iFIX2.0 | → 5.0cisa_csaf_otUS
GE iFix≤ 2.0 - 5.0enisa_euvdEU
GE iFix≤ 5.1enisa_euvdEU
GE iFix≤ 5.8enisa_euvdEU
GE iFix≤ 5.5enisa_euvdEU
ge ifix2.0 → 5.8nvdUScpe:2.3:a:ge:ifix:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

ICSA-18-282-01GE iFix2018-10-09icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could cause a buffer overflow condition.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cisa_csaf_ot nvd NVD CVE.org MITRE

published 2018-10-10modified 2026-06-17

references (7)

External citations — patches, advisories, analysis.

https://ics-cert.us-cert.gov/advisories/ICSA-18-282-01 cnnvd
https://www.ge.com/Patchcnnvd
https://www.securityfocus.com/bid/105540 cnnvd
http://www.securityfocus.com/bid/105540 enisa_euvd
https://ics-cert.us-cert.gov/advisories/ICSA-18-282-01 enisa_euvd
http://www.securityfocus.com/bid/105540Third Party AdvisoryVDB Entrynvd
https://ics-cert.us-cert.gov/advisories/ICSA-18-282-01Third Party AdvisoryUS Government Resourcenvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan