CVE-2020-10611

Опубликовано: 15 апр. 2020

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

Triangle MicroWorks SCADA Data Gateway 3.02.0697 through 4.0.122, 2.41.0213 through 4.0.122 allows remote attackers to execute arbitrary code due to the lack of proper validation of user-supplied data, which can result in a type confusion condition. Authentication is not required to exploit this vulnerability. Only applicable to installations using DNP3 Data Sets.

Ссылки

https://www.us-cert.gov/ics/advisories/icsa-20-105-03
Third Party Advisory
US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-20-549/
Third Party Advisory
VDB Entry
https://www.us-cert.gov/ics/advisories/icsa-20-105-03
Third Party Advisory
US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-20-549/
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:trianglemicroworks:scada_data_gateway:*:*:*:*:*:*:*:*

Версия от 2.41.0213 (включая) до 4.0.122 (включая)

EPSS

Процентиль: 92%

0.09013

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-843

Связанные уязвимости

GHSA-grj9-c593-w7c6

github

больше 3 лет назад