CVE-2016-4523highunder attackCWE-125

CVE-2016-4523

Published · Updated

Follow this CVE+ Monitor VTScada

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 7.5epss 31%
from disclosure to weapon
Published on NVDJun 9
CISA KEV+2136d
Action required by CISAfederal deadline: 2022-05-06

Apply updates per vendor instructions.

In short

The web interface in Trihedral VTScada versions 8.x through 11.x (before 11.2.02) can crash when attackers send specially crafted requests. This causes the application to stop working until it is manually restarted.

Technical detail

An out-of-bounds read vulnerability exists in the WAP interface that allows unauthenticated remote attackers to trigger a denial of service condition. The vulnerability requires no prior authentication and results in application crash; the exact attack vectors are unspecified but affect VTScada versions 8.x through 11.x prior to 11.2.02.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via unspecified vectors.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
n/a · n/a