https://feed.craftedsignal.io/vendors/10-strike/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 26 May 2026 13:38:29 +0000https://feed.craftedsignal.io/briefs/2026-05-10-strike-rce/Tue, 26 May 2026 13:38:29 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-05-10-strike-rce/A buffer overflow vulnerability exists in 10-Strike Network Scanner 3.0, allowing attackers to bypass SafeSEH protections and execute arbitrary code by crafting a malicious payload in the host name or address field and triggering the vulnerability through the Trace route or System information functions.10-Strike Network Scanner 3.0 is susceptible to a buffer overflow vulnerability (CVE-2018-25345) within the host name field. Successful exploitation of this vulnerability allows an attacker to bypass SafeSEH protections and execute arbitrary code within the context of the application. The vulnerability can be triggered via the Trace route or System information functions when processing a crafted host name or address field. This poses a significant risk to organizations utilizing this software, as it could lead to unauthorized access, data breaches, or complete system compromise. The vulnerable version is 3.0.

Attack Chain

1. The attacker identifies a vulnerable instance of 10-Strike Network Scanner 3.0.
2. The attacker crafts a malicious payload designed to exploit the buffer overflow in the host name or address field. The payload is crafted to bypass SafeSEH.
3. The attacker inputs the malicious payload into the host name or address field within the application’s interface.
4. The attacker initiates either the “Trace route” or “System information” function targeting the input containing the malicious payload.
5. The application attempts to process the input, triggering the buffer overflow.
6. The crafted payload overwrites the return address on the stack, bypassing SafeSEH protection.
7. Control is redirected to the attacker-controlled code within the payload.
8. The attacker achieves arbitrary code execution within the context of the Network Scanner application.

Impact

Successful exploitation of CVE-2018-25345 can lead to arbitrary code execution, potentially granting an attacker full control over the affected system. This could result in data breaches, malware installation, or further lateral movement within the network. Given the nature of network scanners, successful exploitation could provide attackers with valuable network reconnaissance capabilities, compounding the impact.

Recommendation

• Monitor process execution for the creation of child processes from the 10-Strike Network Scanner executable, indicating potential exploitation (see Sigma rule “Detect 10-Strike Network Scanner Suspicious Child Process”).
• Implement network segmentation to limit the potential impact of a successful exploit.
• While no patch is available, consider migrating to an alternative solution that provides similar functionality without the vulnerability.

]]>highthreatbuffer-overflowrcewindowshttps://feed.craftedsignal.io/briefs/2026-05-network-inventory-explorer-overflow/Tue, 26 May 2026 13:37:57 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-05-network-inventory-explorer-overflow/10-Strike Network Inventory Explorer 8.54 contains a stack-based buffer overflow vulnerability in the registration key input field that allows local attackers to execute arbitrary code via SEH overwrite.10-Strike Network Inventory Explorer version 8.54 is vulnerable to a stack-based buffer overflow. A local attacker can exploit this vulnerability (CVE-2018-25344) by providing a specially crafted registration key to the application. This crafted input overflows a buffer on the stack, allowing the attacker to overwrite the Structured Exception Handler (SEH) chain and gain arbitrary code execution with the privileges of the running application. The attacker must have local access to the system where the application is installed to exploit this vulnerability. Successful exploitation allows for arbitrary code execution.

Attack Chain

1. The attacker crafts a malicious registration key string.
2. The malicious string contains 4188 bytes of padding to reach the buffer overflow point.
3. After the padding, the string includes carefully chosen SEH chain values (a pointer to the next handler and a pointer to the handler itself).
4. The crafted string also contains shellcode designed to perform malicious actions.
5. The attacker opens 10-Strike Network Inventory Explorer 8.54.
6. The attacker navigates to the registration dialog.
7. The attacker pastes the malicious registration key string into the registration key input field.
8. When the application attempts to process the overly long registration key, a stack buffer overflow occurs, overwriting the SEH chain.
9. When an exception is triggered (likely due to the memory corruption), the overwritten SEH handler is invoked, leading to execution of the attacker-supplied shellcode.
10. The attacker achieves arbitrary code execution with the privileges of the Network Inventory Explorer application.

Impact

Successful exploitation of this buffer overflow vulnerability allows a local attacker to execute arbitrary code on the affected system. Since the code is executed with the privileges of the 10-Strike Network Inventory Explorer application, the attacker can perform actions such as installing malware, accessing sensitive data, or modifying system settings. The CVSS v3.1 base score for this vulnerability is 8.4, indicating a high level of severity.

Recommendation

• Deploy the Sigma rule Detect Network Inventory Explorer SEH Overwrite to identify attempts to exploit the buffer overflow by detecting suspicious SEH overwrites in process creation logs.
• Deploy the Sigma rule Detect Network Inventory Explorer Suspicious Registration to detect suspicious process creation related to Network Inventory Explorer after a registration attempt.
• Consider migrating to a different network inventory solution, or isolating the vulnerable application from sensitive data and critical system processes.

]]>highadvisorybuffer-overflowseh-overwriteprivilege-escalationexecutioncve-2018-25344windows