JVNDB-2024-003188

Panasonic KW Watcher vulnerable to memory buffer error

KW Watcher provided by Panasonic contains a vulnerability due to improper restriction of operations within the bounds of a memory buffer (CWE-119, CVE-2024-4162).

Michael Heinzl reported this vulnerability to Panasonic and coordinated.
After the coordination was completed, Panasonic reported the case to JPCERT/CC to notify users of the solutions through JVN.

Panasonic Corporation

• KW Watcher from Ver.1.00 to Ver.2.83

If a user opens a specially crafted KWW file, information regarding a computer memory map may be guessed or KW Watcher may be terminated abnormally.

[Apply the workaround]
The developer recommends that users should apply following workarounds to mitigate the impacts of this vulnerability.

• Do not open untrusted KWW files


• Stop using a KWW file when leading conditions such as follows by opening it:
  
  
  
  • Display an error dialogue such as "File open error"
  
  
  • Abnormally terminate KW Watcher
  
  
  
  

Panasonic Corporation

• Panasonic : KW Watcher (Electric Power Monitoring software) Ver.2.83 - Panasonic
• Panasonic : Vulnerability Advisory List - Panasonic Holdings

1. Buffer Errors(CWE-119) [Other]

1. CVE-2024-4162

1. JVN : JVNVU#95120091

• [2024/05/17]
    Web page was published