CVE-2011-1566

50Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 67%

from disclosure to weapon0 days

Published on NVDApr 5

1st PoCMar 22

metasploitMar 21

exploitation probability

67%top 1% of all CVEs

observed exploitation

nono source reports it

3 public exploit(s)

Directory traversal vulnerability in dc.exe 9.00.00.11059 and earlier in 7-Technologies Interactive Graphical SCADA System (IGSS) allows remote attackers to execute arbitrary programs via ..\ (dot dot backslash) sequences in opcodes (1) 0xa and (2) 0x17 to TCP port 12397.

Affected products

n/a · n/a

public PoCs found — 3✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/29129 exploitdbwww.exploit-db.com/exploits/17024unverified cve_referencewww.exploit-db.com/exploits/17024unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://aluigi.org/adv/igss_8-adv.txt http://secunia.com/advisories/43849 http://www.exploit-db.com/exploits/17024 http://www.securityfocus.com/bid/46936 http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-080-03.pdf http://www.vupen.com/english/advisories/2011/0741