CVE-2017-14024
Severity Score
9.8
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
A Stack-based Buffer Overflow issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 Patch 1 and prior versions, and InTouch Machine Edition v8.0 SP2 Patch 1 and prior versions. The stack-based buffer overflow vulnerability has been identified, which may allow remote code execution with high privileges.
Se descubrió un problema de desbordamiento de búfer basado en pila en Schneider Electric InduSoft Web Studio v8.0 SP2 Patch 1 o anterior y en InTouch Machine Edition v8.0 SP2 Patch 1 o anterior. La vulnerabilidad de desbordamiento de búfer basado en pila ha sido identificada. Podría permitir la ejecución remota de código con altos privilegios.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2017-08-30 CVE Reserved
- 2017-11-13 CVE Published
- 2024-08-05 CVE Updated
- 2024-09-03 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/101779 | Third Party Advisory | |
| https://ics-cert.us-cert.gov/advisories/ICSA-17-313-02 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Schneider-electric Search vendor "Schneider-electric" | Wonderware Indusoft Web Studio Search vendor "Schneider-electric" for product "Wonderware Indusoft Web Studio" | <= 8.0 Search vendor "Schneider-electric" for product "Wonderware Indusoft Web Studio" and version " <= 8.0" | sp2 |
Affected
| ||||||
| Schneider-electric Search vendor "Schneider-electric" | Wonderware Intouch Search vendor "Schneider-electric" for product "Wonderware Intouch" | <= 8.0 Search vendor "Schneider-electric" for product "Wonderware Intouch" and version " <= 8.0" | sp2, machine |
Affected
| ||||||