CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2023-5909 – Improper Validation of Certificate with Host Mismatch in PTC KEPServerEx
https://notcve.org/view.php?id=CVE-2023-5909
KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect. KEPServerEX no valida adecuadamente los certificados de los clientes, lo que puede permitir que se conecten usuarios no autenticados. • https://www.cisa.gov/news-events/ics-advisories/icsa-23-334-03 • CWE-295: Improper Certificate Validation CWE-297: Improper Validation of Certificate with Host Mismatch •
CVSS: 9.1EPSS: 0%CPEs: 8EXPL: 0CVE-2023-5908 – Heap Based Buffer Overflow in PTC KEPServerEx
https://notcve.org/view.php?id=CVE-2023-5908
KEPServerEX is vulnerable to a buffer overflow which may allow an attacker to crash the product being accessed or leak information. KEPServerEX es vulnerable a un desbordamiento del búfer que puede permitir que un atacante bloquee el producto al que se accede o filtre información. • https://www.cisa.gov/news-events/ics-advisories/icsa-23-334-03 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-122: Heap-based Buffer Overflow •
CVSS: 9.8EPSS: 0%CPEs: 8EXPL: 0CVE-2022-2825 – Kepware KEPServerEX Stack-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-2825
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of text encoding conversions. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-10 https://www.zerodayinitiative.com/advisories/ZDI-22-1455 • CWE-121: Stack-based Buffer Overflow •
CVSS: 9.1EPSS: 0%CPEs: 8EXPL: 0CVE-2022-2848 – Kepware KEPServerEX Heap-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-2848
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of text encoding conversions. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-10 https://www.zerodayinitiative.com/advisories/ZDI-22-1454 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •
CVSS: 7.1EPSS: 0%CPEs: 13EXPL: 0CVE-2013-2804
https://notcve.org/view.php?id=CVE-2013-2804
The DNP Master Driver in Software Toolbox TOP Server before 5.12.140.0 allows remote attackers to cause a denial of service (master-station infinite loop) via crafted DNP3 packets to TCP port 20000 and allows physically proximate attackers to cause a denial of service (master-station infinite loop) via crafted input over a serial line. El controlador DNP Master en Software Toolbox TOP Server anterior a v5.12.140.0 permite a atacantes remotos provocar una denegación de servicio (bucle infinito en la estación master) a través de paquetes DNP3 manipulados hacia el puerto TCP 20000 y permite a los atacantes físicamente próximos a provocar una denegación de servicio (bucle infinito en la estación master) a través de entrada manipulada en una línea serie. • http://ics-cert.us-cert.gov/advisories/ICSA-13-234-02 http://support.softwaretoolbox.com/app/answers/detail/a_id/3014 • CWE-20: Improper Input Validation •