CVE-2015-1007 — A specially crafted configuration file could be used to cause a stack-based buffer overflow condition in the OPCTest.exe, which may allow remote code execution on Opto 22 PAC Project Professional versions prior to R9.4008, PAC Project Basic versions prior to R9.4008, PAC Display Basic versions prior to R9.4g, PAC Display Professional versions prior to R9.4g, OptoOPCServer version R9.4c and prior that were installed by PAC Project installer, versions prior to R9.4008, and OptoDataLink version R9.4d and prior that were installed by PAC Project installer, versions prior to R9.4008

Back Back to CVE browser

HIGH

A specially crafted configuration file could be used to cause a stack-based buffer overflow condition in the OPCTest.exe, which may allow remote code execution on Opto 22 PAC Project Professional versions prior to R9.4008, PAC Project Basic versions prior to R9.4008, PAC Display Basic versions prior to R9.4g, PAC Display Professional versions prior to R9.4g, OptoOPCServer version R9.4c and prior that were installed by PAC Project installer, versions prior to R9.4008, and OptoDataLink version R9.4d and prior that were installed by PAC Project installer, versions prior to R9.4008

Published Mar 25, 2019

7.8

HIGH

CVSS 3.0

EPSS 2.67%

Description

A specially crafted configuration file could be used to cause a stack-based buffer overflow condition in the OPCTest.exe, which may allow remote code execution on Opto 22 PAC Project Professional versions prior to R9.4008, PAC Project Basic versions prior to R9.4008, PAC Display Basic versions prior to R9.4g, PAC Display Professional versions prior to R9.4g, OptoOPCServer version R9.4c and prior that were installed by PAC Project installer, versions prior to R9.4008, and OptoDataLink version R9.4d and prior that were installed by PAC Project installer, versions prior to R9.4008. Opto 22 suggests upgrading to the new product version as soon as possible.

Affected products

Vendor Opto 22 Product OptoDataLink Default
n/a
- Version
  R9.4d and prior that were installed by PAC Project installer versions prior to R9.4008
  Status
  affected
  Constraints
  -
Vendor Opto 22 Product OptoOPCServer Default
n/a
- Version
  R9.4c and prior that were installed by PAC Project installer versions prior to R9.4008
  Status
  affected
  Constraints
  -
Vendor Opto 22 Product PAC Display Basic Default
n/a
- Version
  < R9.4g
  Status
  affected
  Constraints
  -
Vendor Opto 22 Product PAC Display Professional Default
n/a
- Version
  < R9.4g
  Status
  affected
  Constraints
  -
Vendor Opto 22 Product PAC Project Basic Default
n/a
- Version
  < R9.4008
  Status
  affected
  Constraints
  -
Vendor Opto 22 Product PAC Project Professional Default
n/a
- Version
  < R9.4008
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Opto 22

OptoDataLink

n/a

Version	Status	Constraints
R9.4d and prior that were installed by PAC Project installer versions prior to R9.4008	affected	-

Opto 22

OptoOPCServer

n/a

Version	Status	Constraints
R9.4c and prior that were installed by PAC Project installer versions prior to R9.4008	affected	-

Opto 22

PAC Display Basic

n/a

Version	Status	Constraints
< R9.4g	affected	-

Opto 22

PAC Display Professional

n/a

Version	Status	Constraints
< R9.4g	affected	-

Opto 22

PAC Project Basic

n/a

Version	Status	Constraints
< R9.4008	affected	-

Opto 22

PAC Project Professional

n/a

Version	Status	Constraints
< R9.4008	affected	-

Remediation

No remediation recorded yet.

Metrics

2.67% 0.02665

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.02665

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (11 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	2.67% (0.02665)	85.19th	v5 (v2026.06.15)
Jun 15, 2026	2.67% (0.02665)	83.70th	v5 (v2026.06.15)
Mar 17, 2025	0.47% (0.00472)	62.59th	v4 (v2025.03.14)
Feb 1, 2025	2.02% (0.02015)	88.71th	v3 (v2023.03.01)
Dec 17, 2024	4.56% (0.04557)	92.41th	v3 (v2023.03.01)
Feb 8, 2024	0.33% (0.00325)	69.98th	v3 (v2023.03.01)
Mar 7, 2023	0.33% (0.00325)	66.09th	v3 (v2023.03.01)
Mar 6, 2023	1.10% (0.01103)	53.77th	v2 (v2022.01.01)
Sep 15, 2022	1.10% (0.01103)	52.07th	v2 (v2022.01.01)
Apr 1, 2022	1.10% (0.01103)	50.07th	v2 (v2022.01.01)
Feb 4, 2022	1.10% (0.01103)	28.56th	v2 (v2022.01.01)

Weaknesses (2)

CWE-119

Buffer Overflow

CWE-121

References (1)

https://ics-cert.us-cert.gov/advisories/ICSA-15-120-01
x_refsource_MISCThird Party AdvisoryUS Government Resource

Link	Providers	Tags
https://ics-cert.us-cert.gov/advisories/ICSA-15-120-01		x_refsource_MISCThird Party AdvisoryUS Government Resource

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner icscert

Published Mar 25, 2019

Updated Aug 6, 2024

Reserved Jan 10, 2015

Link CVE-2015-1007

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2015-1007

Red Hat

Severity n/a

Public date n/a

Links CVE-2015-1007