// For flags

CVE-2019-10965

 

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

In Emerson Ovation OCR400 Controller 3.3.1 and earlier, a heap-based buffer overflow vulnerability in the embedded third-party FTP server involves improper handling of a long command to the FTP service, which may cause memory corruption that halts the controller or leads to remote code execution and escalation of privileges.

En el Controlador Emerson Ovation OCR400 versión 3.3.1 y anteriores, una vulnerabilidad de desbordamiento del búfer en memória dinámica (heap) de la memoria del servidor FTP incorporado de terceros implica el manejo inadecuado de un comando largo al servicio FTP, lo que puede generar daños en la memoria que paraliza el controlador o provoca la ejecución de código remota y escalada de privilegios.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-04-08 CVE Reserved
  • 2019-05-28 CVE Published
  • 2024-08-04 CVE Updated
  • 2024-10-18 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-787: Out-of-bounds Write
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Emerson
Search vendor "Emerson"
Ovation Ocr400 Firmware
Search vendor "Emerson" for product "Ovation Ocr400 Firmware"
<= 3.3.1
Search vendor "Emerson" for product "Ovation Ocr400 Firmware" and version " <= 3.3.1"
-
Affected
in Emerson
Search vendor "Emerson"
Ovation Ocr400
Search vendor "Emerson" for product "Ovation Ocr400"
--
Safe