Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner

Sources

Vulnerability from variot - Updated: 2023-12-18 12:44

An Information Exposure issue was discovered in Trihedral VTScada Versions prior to 11.2.26. Some files are exposed within the web server application to unauthenticated users. These files may contain sensitive configuration information. Trihedral VTScada (formerly known as VTS) is a SCADA system based on the Windows platform provided by Trihedral Engineering of Canada. Trihedral VTScada is prone to multiple security vulnerabilities: 1. A denial-of-service vulnerability. 2. A cross-site scripting vulnerability. 3. An information-disclosure vulnerability. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. Failed exploit attempts will likely result in denial-of-service conditions. Vendor: Trihedral Equipment: VTScada Vulnerability: Resource Consumption, Cross-Site Scripting, Information Exposure Advisory URL: https://ipositivesecurity.com/2017/06/15/ics-trihedral-vtscada-multiple-vulnerabilities/

ICS-CERT Advisory https://ics-cert.us-cert.gov/advisories/ICSA-17-164-01

AFFECTED PRODUCTS

The following versions of VTScada, an HMI SCADA software, are affected:

VTScada Versions prior to 11.2.26

IMPACT

Successful exploitation of these vulnerabilities could result in uncontrolled resource consumption, arbitrary code execution, or information exposure.

VULNERABILITY OVERVIEW

UNCONTROLLED RESOURCE CONSUMPTION CWE-400 https://cwe.mitre.org/data/definitions/400.html

The client does not properly validate the input or limit the amount of resources that are utilized by an attacker, which can be used to consume more resources than are available. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H ).

Exploitation

Note that this vulnerability targets the VTScada thick client installed on the system. Any application user (including a non-admin, restricted user) who has access to the thick client can potentially bring down the system.

Payload can be up to ~80k characters. Repeated attempts result in spiked CPU usage & consumption of RAM / page resources. Where a full-blown application (or multiple applications in production scenario) is deployed, i.e. with an operational/functional configuration, memory/CPU usage is notably higher than that of a test, blank application. Repeatedly submitting such a large username input, rapidly consumes available server memory resources leading to resource exhaustion. This forces a system reboot eventually.

Where an endpoint security solution (such as AV/HIPS/Anti-Malware) is deployed on the system, resource exhaustion may be achieved relatively much faster (quickly). A CVSS v3 base score of 6.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N ).

Exploitation

Multiple URLs and parameters were found to vulnerable to Reflected Cross-Site Scripting. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N )

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201706-0469",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "vtscada",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "trihedral",
        "version": "11.2.23"
      },
      {
        "model": "vtscada",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "trihedral engineering",
        "version": "11.2.26"
      },
      {
        "model": "vtscada",
        "scope": "lt",
        "trust": 0.6,
        "vendor": "trihedral",
        "version": "11.2.26"
      },
      {
        "model": "vtscada",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "trihedral",
        "version": "11.2.23"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "11.2.2"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "11.1.18"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "11.1.17"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "11.2"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "11.1.09"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "11.1.07"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "11.0"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "11"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "10.2.22"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "10.2"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "10.1"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "10"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "09.1.20"
      },
      {
        "model": "engineering vtscada",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "11.2.26"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "vtscada",
        "version": "*"
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "88db1989-3529-4cae-9472-2d7b6e93ab47"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-10706"
      },
      {
        "db": "BID",
        "id": "99066"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004918"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-6045"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-829"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:trihedral:vtscada:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "11.2.23",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-6045"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Karn Ganeshen.",
    "sources": [
      {
        "db": "BID",
        "id": "99066"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-829"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2017-6045",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 5.0,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "CVE-2017-6045",
            "impactScore": null,
            "integrityImpact": "None",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "NONE",
            "baseScore": 7.8,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "CNVD-2017-10706",
            "impactScore": 6.9,
            "integrityImpact": "NONE",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "IVD",
            "availabilityImpact": "NONE",
            "baseScore": 7.8,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "88db1989-3529-4cae-9472-2d7b6e93ab47",
            "impactScore": 6.9,
            "integrityImpact": "NONE",
            "severity": "HIGH",
            "trust": 0.2,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
            "version": "2.9 [IVD]"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 7.5,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2017-6045",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2017-6045",
            "trust": 1.8,
            "value": "HIGH"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2017-10706",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201706-829",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "IVD",
            "id": "88db1989-3529-4cae-9472-2d7b6e93ab47",
            "trust": 0.2,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "88db1989-3529-4cae-9472-2d7b6e93ab47"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-10706"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004918"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-6045"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-829"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "An Information Exposure issue was discovered in Trihedral VTScada Versions prior to 11.2.26. Some files are exposed within the web server application to unauthenticated users. These files may contain sensitive configuration information. Trihedral VTScada (formerly known as VTS) is a SCADA system based on the Windows platform provided by Trihedral Engineering of Canada. Trihedral VTScada is prone to multiple security vulnerabilities:\n1. A denial-of-service vulnerability. \n2. A cross-site scripting vulnerability. \n3. An information-disclosure vulnerability. \nAn attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. Failed exploit attempts will likely result in denial-of-service conditions. Vendor: Trihedral\nEquipment: VTScada\nVulnerability: Resource Consumption, Cross-Site Scripting, Information\nExposure\nAdvisory URL:\nhttps://ipositivesecurity.com/2017/06/15/ics-trihedral-vtscada-multiple-vulnerabilities/\n\nICS-CERT Advisory\nhttps://ics-cert.us-cert.gov/advisories/ICSA-17-164-01\n\n------------------------\nAFFECTED PRODUCTS\n------------------------\nThe following versions of VTScada, an HMI SCADA software, are affected:\n\nVTScada Versions prior to 11.2.26\n\n------------------------\nIMPACT\n------------------------\n\nSuccessful exploitation of these vulnerabilities could result in\nuncontrolled resource consumption, arbitrary code execution, or information\nexposure. \n\n------------------------\nVULNERABILITY OVERVIEW\n------------------------\n\nUNCONTROLLED RESOURCE CONSUMPTION CWE-400\n\u003chttps://cwe.mitre.org/data/definitions/400.html\u003e\n\nThe client does not properly validate the input or limit the amount of\nresources that are utilized by an attacker, which can be used to consume\nmore resources than are available. A CVSS v3 base score of 7.5 has been\nassigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\u003chttps://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\u003e\n). \n\nExploitation\n\nNote that this vulnerability targets the VTScada thick client installed on\nthe system. Any application user (including a non-admin, restricted user)\nwho has access to the thick client can potentially bring down the system. \n\nPayload can be up to ~80k characters. Repeated attempts result in spiked\nCPU usage \u0026 consumption of RAM / page resources. Where a full-blown\napplication (or multiple applications in production scenario) is deployed,\ni.e. with an operational/functional configuration, memory/CPU usage is\nnotably higher than that of a test, blank application. Repeatedly\nsubmitting such a large username input, rapidly consumes available server\nmemory resources leading to resource exhaustion. This forces a system\nreboot eventually. \n\nWhere an endpoint security solution (such as AV/HIPS/Anti-Malware) is\ndeployed on the system, resource exhaustion may be achieved relatively much\nfaster (quickly). A CVSS v3 base score of 6.5 has been\nassigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\n\u003chttps://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\u003e\n). \n\nExploitation\n\nMultiple URLs and parameters were found to vulnerable to Reflected\nCross-Site Scripting. A CVSS v3 base score of 7.5 has been\nassigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n\u003chttps://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\u003e\n)",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-6045"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004918"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-10706"
      },
      {
        "db": "BID",
        "id": "99066"
      },
      {
        "db": "IVD",
        "id": "88db1989-3529-4cae-9472-2d7b6e93ab47"
      },
      {
        "db": "PACKETSTORM",
        "id": "143216"
      }
    ],
    "trust": 2.7
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2017-6045",
        "trust": 3.6
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-17-164-01",
        "trust": 3.4
      },
      {
        "db": "BID",
        "id": "99066",
        "trust": 2.5
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-10706",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-829",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004918",
        "trust": 0.8
      },
      {
        "db": "IVD",
        "id": "88DB1989-3529-4CAE-9472-2D7B6E93AB47",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "143216",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "88db1989-3529-4cae-9472-2d7b6e93ab47"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-10706"
      },
      {
        "db": "BID",
        "id": "99066"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004918"
      },
      {
        "db": "PACKETSTORM",
        "id": "143216"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-6045"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-829"
      }
    ]
  },
  "id": "VAR-201706-0469",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "IVD",
        "id": "88db1989-3529-4cae-9472-2d7b6e93ab47"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-10706"
      }
    ],
    "trust": 1.39210527
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "88db1989-3529-4cae-9472-2d7b6e93ab47"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-10706"
      }
    ]
  },
  "last_update_date": "2023-12-18T12:44:32.062000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "https://www.trihedral.com/"
      },
      {
        "title": "Trihedral VTScada Information Disclosure Vulnerability Patch",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchinfo/show/96153"
      },
      {
        "title": "Trihedral VTScada Repair measures for information disclosure vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=71097"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2017-10706"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004918"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-829"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-200",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004918"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-6045"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.4,
        "url": "https://ics-cert.us-cert.gov/advisories/icsa-17-164-01"
      },
      {
        "trust": 2.2,
        "url": "http://www.securityfocus.com/bid/99066"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-6045"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-6045"
      },
      {
        "trust": 0.3,
        "url": "www.trihedral.com"
      },
      {
        "trust": 0.1,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2017-6045\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/79.html\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2017-6053\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/400.html\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2017-6043\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://www.first.org/cvss/calculator/3.0#cvss:3.0/av:n/ac:l/pr:n/ui:n/s:u/c:h/i:n/a:n\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://www.first.org/cvss/calculator/3.0#cvss:3.0/av:n/ac:l/pr:n/ui:n/s:u/c:n/i:n/a:h\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://www.first.org/cvss/calculator/3.0#cvss:3.0/av:n/ac:l/pr:n/ui:r/s:u/c:h/i:n/a:n\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/548.html\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://ipositivesecurity.com/2017/06/15/ics-trihedral-vtscada-multiple-vulnerabilities/"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2017-10706"
      },
      {
        "db": "BID",
        "id": "99066"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004918"
      },
      {
        "db": "PACKETSTORM",
        "id": "143216"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-6045"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-829"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "IVD",
        "id": "88db1989-3529-4cae-9472-2d7b6e93ab47"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-10706"
      },
      {
        "db": "BID",
        "id": "99066"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004918"
      },
      {
        "db": "PACKETSTORM",
        "id": "143216"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-6045"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-829"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-06-22T00:00:00",
        "db": "IVD",
        "id": "88db1989-3529-4cae-9472-2d7b6e93ab47"
      },
      {
        "date": "2017-06-22T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2017-10706"
      },
      {
        "date": "2017-06-13T00:00:00",
        "db": "BID",
        "id": "99066"
      },
      {
        "date": "2017-07-11T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-004918"
      },
      {
        "date": "2017-06-30T11:11:11",
        "db": "PACKETSTORM",
        "id": "143216"
      },
      {
        "date": "2017-06-21T19:29:00.307000",
        "db": "NVD",
        "id": "CVE-2017-6045"
      },
      {
        "date": "2017-06-20T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201706-829"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-06-22T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2017-10706"
      },
      {
        "date": "2017-06-13T00:00:00",
        "db": "BID",
        "id": "99066"
      },
      {
        "date": "2017-07-11T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-004918"
      },
      {
        "date": "2019-10-09T23:28:37.857000",
        "db": "NVD",
        "id": "CVE-2017-6045"
      },
      {
        "date": "2019-10-17T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201706-829"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-829"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Trihedral VTScada Information Disclosure Vulnerability",
    "sources": [
      {
        "db": "IVD",
        "id": "88db1989-3529-4cae-9472-2d7b6e93ab47"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-10706"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-829"
      }
    ],
    "trust": 1.4
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "information disclosure",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-829"
      }
    ],
    "trust": 0.6
  }
}

VAR-201706-0451

Vulnerability from variot - Updated: 2023-12-18 12:44

A Cross-Site Scripting issue was discovered in Trihedral VTScada Versions prior to 11.2.26. A cross-site scripting vulnerability may allow JavaScript code supplied by the attacker to execute within the user's browser. Trihedral VTScada (formerly known as VTS) is a SCADA system based on the Windows platform provided by Trihedral Engineering of Canada. A remote attacker can exploit this vulnerability to inject arbitrary web scripts or HTML. Trihedral VTScada is prone to multiple security vulnerabilities: 1. A denial-of-service vulnerability. 2. 3. An information-disclosure vulnerability. This can allow the attacker to steal cookie-based authentication credentials or gain access to sensitive information. Failed exploit attempts will likely result in denial-of-service conditions. Vendor: Trihedral Equipment: VTScada Vulnerability: Resource Consumption, Cross-Site Scripting, Information Exposure Advisory URL: https://ipositivesecurity.com/2017/06/15/ics-trihedral-vtscada-multiple-vulnerabilities/

ICS-CERT Advisory https://ics-cert.us-cert.gov/advisories/ICSA-17-164-01

AFFECTED PRODUCTS

The following versions of VTScada, an HMI SCADA software, are affected:

VTScada Versions prior to 11.2.26

IMPACT

Successful exploitation of these vulnerabilities could result in uncontrolled resource consumption, arbitrary code execution, or information exposure.

VULNERABILITY OVERVIEW

UNCONTROLLED RESOURCE CONSUMPTION CWE-400 https://cwe.mitre.org/data/definitions/400.html

Exploitation

Multiple URLs and parameters were found to vulnerable to Reflected Cross-Site Scripting.

INFORMATION EXPOSURE CWE-548 https://cwe.mitre.org/data/definitions/548.html

Some files are exposed within the web server application to unauthenticated users. These files may contain sensitive configuration information. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N )

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201706-0451",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "vtscada",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "trihedral",
        "version": "11.2.23"
      },
      {
        "model": "vtscada",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "trihedral engineering",
        "version": "11.2.26"
      },
      {
        "model": "vtscada",
        "scope": "lt",
        "trust": 0.6,
        "vendor": "trihedral",
        "version": "11.2.26"
      },
      {
        "model": "vtscada",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "trihedral",
        "version": "11.2.23"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "11.2.2"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "11.1.18"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "11.1.17"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "11.2"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "11.1.09"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "11.1.07"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "11.0"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "11"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "10.2.22"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "10.2"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "10.1"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "10"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "09.1.20"
      },
      {
        "model": "engineering vtscada",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "11.2.26"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "vtscada",
        "version": "*"
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "1788e17d-8e84-4c5e-b3bc-4dc712136483"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-10708"
      },
      {
        "db": "BID",
        "id": "99066"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004919"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-6053"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-831"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:trihedral:vtscada:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "11.2.23",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-6053"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Karn Ganeshen.",
    "sources": [
      {
        "db": "BID",
        "id": "99066"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-831"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2017-6053",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": true,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Medium",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 4.3,
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2017-6053",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "NONE",
            "baseScore": 7.8,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "CNVD-2017-10708",
            "impactScore": 6.9,
            "integrityImpact": "NONE",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "IVD",
            "availabilityImpact": "NONE",
            "baseScore": 7.8,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "1788e17d-8e84-4c5e-b3bc-4dc712136483",
            "impactScore": 6.9,
            "integrityImpact": "NONE",
            "severity": "HIGH",
            "trust": 0.2,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
            "version": "2.9 [IVD]"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitabilityScore": 2.8,
            "impactScore": 2.7,
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "trust": 1.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 6.1,
            "baseSeverity": "Medium",
            "confidentialityImpact": "Low",
            "exploitabilityScore": null,
            "id": "CVE-2017-6053",
            "impactScore": null,
            "integrityImpact": "Low",
            "privilegesRequired": "None",
            "scope": "Changed",
            "trust": 0.8,
            "userInteraction": "Required",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2017-6053",
            "trust": 1.8,
            "value": "MEDIUM"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2017-10708",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201706-831",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "IVD",
            "id": "1788e17d-8e84-4c5e-b3bc-4dc712136483",
            "trust": 0.2,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "1788e17d-8e84-4c5e-b3bc-4dc712136483"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-10708"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004919"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-6053"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-831"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "A Cross-Site Scripting issue was discovered in Trihedral VTScada Versions prior to 11.2.26. A cross-site scripting vulnerability may allow JavaScript code supplied by the attacker to execute within the user\u0027s browser. Trihedral VTScada (formerly known as VTS) is a SCADA system based on the Windows platform provided by Trihedral Engineering of Canada. A remote attacker can exploit this vulnerability to inject arbitrary web scripts or HTML. Trihedral VTScada is prone to multiple security vulnerabilities:\n1. A denial-of-service vulnerability. \n2. \n3. An information-disclosure vulnerability. This can allow the attacker to steal cookie-based authentication credentials or gain access to sensitive information. Failed exploit attempts will likely result in denial-of-service conditions. Vendor: Trihedral\nEquipment: VTScada\nVulnerability: Resource Consumption, Cross-Site Scripting, Information\nExposure\nAdvisory URL:\nhttps://ipositivesecurity.com/2017/06/15/ics-trihedral-vtscada-multiple-vulnerabilities/\n\nICS-CERT Advisory\nhttps://ics-cert.us-cert.gov/advisories/ICSA-17-164-01\n\n------------------------\nAFFECTED PRODUCTS\n------------------------\nThe following versions of VTScada, an HMI SCADA software, are affected:\n\nVTScada Versions prior to 11.2.26\n\n------------------------\nIMPACT\n------------------------\n\nSuccessful exploitation of these vulnerabilities could result in\nuncontrolled resource consumption, arbitrary code execution, or information\nexposure. \n\n------------------------\nVULNERABILITY OVERVIEW\n------------------------\n\nUNCONTROLLED RESOURCE CONSUMPTION CWE-400\n\u003chttps://cwe.mitre.org/data/definitions/400.html\u003e\n\nThe client does not properly validate the input or limit the amount of\nresources that are utilized by an attacker, which can be used to consume\nmore resources than are available. A CVSS v3 base score of 7.5 has been\nassigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\u003chttps://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\u003e\n). \n\nExploitation\n\nNote that this vulnerability targets the VTScada thick client installed on\nthe system. Any application user (including a non-admin, restricted user)\nwho has access to the thick client can potentially bring down the system. \n\nPayload can be up to ~80k characters. Repeated attempts result in spiked\nCPU usage \u0026 consumption of RAM / page resources. Where a full-blown\napplication (or multiple applications in production scenario) is deployed,\ni.e. with an operational/functional configuration, memory/CPU usage is\nnotably higher than that of a test, blank application. Repeatedly\nsubmitting such a large username input, rapidly consumes available server\nmemory resources leading to resource exhaustion. This forces a system\nreboot eventually. \n\nWhere an endpoint security solution (such as AV/HIPS/Anti-Malware) is\ndeployed on the system, resource exhaustion may be achieved relatively much\nfaster (quickly). A CVSS v3 base score of 6.5 has been\nassigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\n\u003chttps://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\u003e\n). \n\nExploitation\n\nMultiple URLs and parameters were found to vulnerable to Reflected\nCross-Site Scripting. \n\nINFORMATION EXPOSURE CWE-548\n\u003chttps://cwe.mitre.org/data/definitions/548.html\u003e\n\nSome files are exposed within the web server application to unauthenticated\nusers. These files may contain sensitive configuration information. A CVSS v3 base score of 7.5 has been\nassigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n\u003chttps://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\u003e\n)",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-6053"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004919"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-10708"
      },
      {
        "db": "BID",
        "id": "99066"
      },
      {
        "db": "IVD",
        "id": "1788e17d-8e84-4c5e-b3bc-4dc712136483"
      },
      {
        "db": "PACKETSTORM",
        "id": "143216"
      }
    ],
    "trust": 2.7
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2017-6053",
        "trust": 3.6
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-17-164-01",
        "trust": 3.4
      },
      {
        "db": "BID",
        "id": "99066",
        "trust": 2.5
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-10708",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-831",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004919",
        "trust": 0.8
      },
      {
        "db": "IVD",
        "id": "1788E17D-8E84-4C5E-B3BC-4DC712136483",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "143216",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "1788e17d-8e84-4c5e-b3bc-4dc712136483"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-10708"
      },
      {
        "db": "BID",
        "id": "99066"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004919"
      },
      {
        "db": "PACKETSTORM",
        "id": "143216"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-6053"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-831"
      }
    ]
  },
  "id": "VAR-201706-0451",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "IVD",
        "id": "1788e17d-8e84-4c5e-b3bc-4dc712136483"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-10708"
      }
    ],
    "trust": 1.39210527
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "1788e17d-8e84-4c5e-b3bc-4dc712136483"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-10708"
      }
    ]
  },
  "last_update_date": "2023-12-18T12:44:32.024000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "https://www.trihedral.com/"
      },
      {
        "title": "Trihedral VTScada Cross-Site Scripting Vulnerability Patch",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchinfo/show/96154"
      },
      {
        "title": "Trihedral VTScada Fixes for cross-site scripting vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=71099"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2017-10708"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004919"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-831"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-79",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004919"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-6053"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.4,
        "url": "https://ics-cert.us-cert.gov/advisories/icsa-17-164-01"
      },
      {
        "trust": 2.2,
        "url": "http://www.securityfocus.com/bid/99066"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-6053"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-6053"
      },
      {
        "trust": 0.3,
        "url": "www.trihedral.com"
      },
      {
        "trust": 0.1,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2017-6045\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/79.html\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2017-6053\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/400.html\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2017-6043\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://www.first.org/cvss/calculator/3.0#cvss:3.0/av:n/ac:l/pr:n/ui:n/s:u/c:h/i:n/a:n\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://www.first.org/cvss/calculator/3.0#cvss:3.0/av:n/ac:l/pr:n/ui:n/s:u/c:n/i:n/a:h\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://www.first.org/cvss/calculator/3.0#cvss:3.0/av:n/ac:l/pr:n/ui:r/s:u/c:h/i:n/a:n\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/548.html\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://ipositivesecurity.com/2017/06/15/ics-trihedral-vtscada-multiple-vulnerabilities/"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2017-10708"
      },
      {
        "db": "BID",
        "id": "99066"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004919"
      },
      {
        "db": "PACKETSTORM",
        "id": "143216"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-6053"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-831"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "IVD",
        "id": "1788e17d-8e84-4c5e-b3bc-4dc712136483"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-10708"
      },
      {
        "db": "BID",
        "id": "99066"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004919"
      },
      {
        "db": "PACKETSTORM",
        "id": "143216"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-6053"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-831"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-06-22T00:00:00",
        "db": "IVD",
        "id": "1788e17d-8e84-4c5e-b3bc-4dc712136483"
      },
      {
        "date": "2017-06-22T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2017-10708"
      },
      {
        "date": "2017-06-13T00:00:00",
        "db": "BID",
        "id": "99066"
      },
      {
        "date": "2017-07-11T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-004919"
      },
      {
        "date": "2017-06-30T11:11:11",
        "db": "PACKETSTORM",
        "id": "143216"
      },
      {
        "date": "2017-06-21T19:29:00.370000",
        "db": "NVD",
        "id": "CVE-2017-6053"
      },
      {
        "date": "2017-06-20T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201706-831"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-07-03T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2017-10708"
      },
      {
        "date": "2017-06-13T00:00:00",
        "db": "BID",
        "id": "99066"
      },
      {
        "date": "2017-07-11T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-004919"
      },
      {
        "date": "2019-10-09T23:28:38.917000",
        "db": "NVD",
        "id": "CVE-2017-6053"
      },
      {
        "date": "2019-10-17T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201706-831"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-831"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Trihedral VTScada Cross-Site Scripting Vulnerability",
    "sources": [
      {
        "db": "IVD",
        "id": "1788e17d-8e84-4c5e-b3bc-4dc712136483"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-10708"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-831"
      }
    ],
    "trust": 1.4
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "XSS",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-831"
      }
    ],
    "trust": 0.6
  }
}

VAR-201706-0467

Vulnerability from variot - Updated: 2023-12-18 12:44

A Resource Consumption issue was discovered in Trihedral VTScada Versions prior to 11.2.26. The client does not properly validate the input or limit the amount of resources that are utilized by an attacker, which can be used to consume more resources than are available. Trihedral VTScada Contains a resource exhaustion vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Trihedral VTScada (formerly known as VTS) is a SCADA system based on the Windows platform provided by Trihedral Engineering of Canada. A denial of service vulnerability exists in versions of Trihedral VTScada prior to 11.2.26 that caused the program to fail to validate input or limit the total amount of resources used. An attacker could exploit the vulnerability to cause a denial of service (a significant drain on resources). Trihedral VTScada is prone to multiple security vulnerabilities: 1. A denial-of-service vulnerability. 2. A cross-site scripting vulnerability. 3. An information-disclosure vulnerability. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials or gain access to sensitive information. Failed exploit attempts will likely result in denial-of-service conditions. Vendor: Trihedral Equipment: VTScada Vulnerability: Resource Consumption, Cross-Site Scripting, Information Exposure Advisory URL: https://ipositivesecurity.com/2017/06/15/ics-trihedral-vtscada-multiple-vulnerabilities/

ICS-CERT Advisory https://ics-cert.us-cert.gov/advisories/ICSA-17-164-01

AFFECTED PRODUCTS

The following versions of VTScada, an HMI SCADA software, are affected:

VTScada Versions prior to 11.2.26

IMPACT

Successful exploitation of these vulnerabilities could result in uncontrolled resource consumption, arbitrary code execution, or information exposure. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H ).

Exploitation

Multiple URLs and parameters were found to vulnerable to Reflected Cross-Site Scripting.

INFORMATION EXPOSURE CWE-548 https://cwe.mitre.org/data/definitions/548.html

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201706-0467",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "vtscada",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "trihedral",
        "version": "11.2.23"
      },
      {
        "model": "vtscada",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "trihedral engineering",
        "version": "11.2.26"
      },
      {
        "model": "vtscada",
        "scope": "lt",
        "trust": 0.6,
        "vendor": "trihedral",
        "version": "11.2.26"
      },
      {
        "model": "vtscada",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "trihedral",
        "version": "11.2.23"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "11.2.2"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "11.1.18"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "11.1.17"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "11.2"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "11.1.09"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "11.1.07"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "11.0"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "11"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "10.2.22"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "10.2"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "10.1"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "10"
      },
      {
        "model": "engineering vtscada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "09.1.20"
      },
      {
        "model": "engineering vtscada",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "11.2.26"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "vtscada",
        "version": "*"
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "a084bafc-df0b-469d-85a8-46c98d18dce9"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-10707"
      },
      {
        "db": "BID",
        "id": "99066"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004917"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-6043"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-830"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:trihedral:vtscada:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "11.2.23",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-6043"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Karn Ganeshen.",
    "sources": [
      {
        "db": "BID",
        "id": "99066"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-830"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2017-6043",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.8,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "impactScore": 6.9,
            "integrityImpact": "NONE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "HIGH",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Complete",
            "baseScore": 7.8,
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2017-6043",
            "impactScore": null,
            "integrityImpact": "None",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.8,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "CNVD-2017-10707",
            "impactScore": 6.9,
            "integrityImpact": "NONE",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "IVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.8,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "a084bafc-df0b-469d-85a8-46c98d18dce9",
            "impactScore": 6.9,
            "integrityImpact": "NONE",
            "severity": "HIGH",
            "trust": 0.2,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
            "version": "2.9 [IVD]"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 3.9,
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 7.5,
            "baseSeverity": "High",
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2017-6043",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2017-6043",
            "trust": 1.8,
            "value": "HIGH"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2017-10707",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201706-830",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "IVD",
            "id": "a084bafc-df0b-469d-85a8-46c98d18dce9",
            "trust": 0.2,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "a084bafc-df0b-469d-85a8-46c98d18dce9"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-10707"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004917"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-6043"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-830"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "A Resource Consumption issue was discovered in Trihedral VTScada Versions prior to 11.2.26. The client does not properly validate the input or limit the amount of resources that are utilized by an attacker, which can be used to consume more resources than are available. Trihedral VTScada Contains a resource exhaustion vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Trihedral VTScada (formerly known as VTS) is a SCADA system based on the Windows platform provided by Trihedral Engineering of Canada. A denial of service vulnerability exists in versions of Trihedral VTScada prior to 11.2.26 that caused the program to fail to validate input or limit the total amount of resources used. An attacker could exploit the vulnerability to cause a denial of service (a significant drain on resources). Trihedral VTScada is prone to multiple security vulnerabilities:\n1. A denial-of-service vulnerability. \n2. A cross-site scripting vulnerability. \n3. An information-disclosure vulnerability. \nAn attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials or gain access to sensitive information. Failed exploit attempts will likely result in denial-of-service conditions. Vendor: Trihedral\nEquipment: VTScada\nVulnerability: Resource Consumption, Cross-Site Scripting, Information\nExposure\nAdvisory URL:\nhttps://ipositivesecurity.com/2017/06/15/ics-trihedral-vtscada-multiple-vulnerabilities/\n\nICS-CERT Advisory\nhttps://ics-cert.us-cert.gov/advisories/ICSA-17-164-01\n\n------------------------\nAFFECTED PRODUCTS\n------------------------\nThe following versions of VTScada, an HMI SCADA software, are affected:\n\nVTScada Versions prior to 11.2.26\n\n------------------------\nIMPACT\n------------------------\n\nSuccessful exploitation of these vulnerabilities could result in\nuncontrolled resource consumption, arbitrary code execution, or information\nexposure. A CVSS v3 base score of 7.5 has been\nassigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\u003chttps://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\u003e\n). \n\nExploitation\n\nNote that this vulnerability targets the VTScada thick client installed on\nthe system. Any application user (including a non-admin, restricted user)\nwho has access to the thick client can potentially bring down the system. \n\nPayload can be up to ~80k characters. Repeated attempts result in spiked\nCPU usage \u0026 consumption of RAM / page resources. Where a full-blown\napplication (or multiple applications in production scenario) is deployed,\ni.e. with an operational/functional configuration, memory/CPU usage is\nnotably higher than that of a test, blank application. Repeatedly\nsubmitting such a large username input, rapidly consumes available server\nmemory resources leading to resource exhaustion. This forces a system\nreboot eventually. \n\nWhere an endpoint security solution (such as AV/HIPS/Anti-Malware) is\ndeployed on the system, resource exhaustion may be achieved relatively much\nfaster (quickly). A CVSS v3 base score of 6.5 has been\nassigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\n\u003chttps://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\u003e\n). \n\nExploitation\n\nMultiple URLs and parameters were found to vulnerable to Reflected\nCross-Site Scripting. \n\nINFORMATION EXPOSURE CWE-548\n\u003chttps://cwe.mitre.org/data/definitions/548.html\u003e\n\nSome files are exposed within the web server application to unauthenticated\nusers. These files may contain sensitive configuration information. A CVSS v3 base score of 7.5 has been\nassigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n\u003chttps://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\u003e\n)",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-6043"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004917"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-10707"
      },
      {
        "db": "BID",
        "id": "99066"
      },
      {
        "db": "IVD",
        "id": "a084bafc-df0b-469d-85a8-46c98d18dce9"
      },
      {
        "db": "PACKETSTORM",
        "id": "143216"
      }
    ],
    "trust": 2.7
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2017-6043",
        "trust": 3.6
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-17-164-01",
        "trust": 3.4
      },
      {
        "db": "BID",
        "id": "99066",
        "trust": 2.5
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-10707",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-830",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004917",
        "trust": 0.8
      },
      {
        "db": "IVD",
        "id": "A084BAFC-DF0B-469D-85A8-46C98D18DCE9",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "143216",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "a084bafc-df0b-469d-85a8-46c98d18dce9"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-10707"
      },
      {
        "db": "BID",
        "id": "99066"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004917"
      },
      {
        "db": "PACKETSTORM",
        "id": "143216"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-6043"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-830"
      }
    ]
  },
  "id": "VAR-201706-0467",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "IVD",
        "id": "a084bafc-df0b-469d-85a8-46c98d18dce9"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-10707"
      }
    ],
    "trust": 1.39210527
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "a084bafc-df0b-469d-85a8-46c98d18dce9"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-10707"
      }
    ]
  },
  "last_update_date": "2023-12-18T12:44:31.985000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "https://www.trihedral.com/"
      },
      {
        "title": "Trihedral VTScada denial of service vulnerability patch",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchinfo/show/96152"
      },
      {
        "title": "Trihedral VTScada Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=71098"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2017-10707"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004917"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-830"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-400",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004917"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-6043"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.4,
        "url": "https://ics-cert.us-cert.gov/advisories/icsa-17-164-01"
      },
      {
        "trust": 2.2,
        "url": "http://www.securityfocus.com/bid/99066"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-6043"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-6043"
      },
      {
        "trust": 0.3,
        "url": "www.trihedral.com"
      },
      {
        "trust": 0.1,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2017-6045\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/79.html\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2017-6053\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/400.html\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2017-6043\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://www.first.org/cvss/calculator/3.0#cvss:3.0/av:n/ac:l/pr:n/ui:n/s:u/c:h/i:n/a:n\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://www.first.org/cvss/calculator/3.0#cvss:3.0/av:n/ac:l/pr:n/ui:n/s:u/c:n/i:n/a:h\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://www.first.org/cvss/calculator/3.0#cvss:3.0/av:n/ac:l/pr:n/ui:r/s:u/c:h/i:n/a:n\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/548.html\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://ipositivesecurity.com/2017/06/15/ics-trihedral-vtscada-multiple-vulnerabilities/"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2017-10707"
      },
      {
        "db": "BID",
        "id": "99066"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004917"
      },
      {
        "db": "PACKETSTORM",
        "id": "143216"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-6043"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-830"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "IVD",
        "id": "a084bafc-df0b-469d-85a8-46c98d18dce9"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-10707"
      },
      {
        "db": "BID",
        "id": "99066"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004917"
      },
      {
        "db": "PACKETSTORM",
        "id": "143216"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-6043"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-830"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-06-22T00:00:00",
        "db": "IVD",
        "id": "a084bafc-df0b-469d-85a8-46c98d18dce9"
      },
      {
        "date": "2017-06-22T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2017-10707"
      },
      {
        "date": "2017-06-13T00:00:00",
        "db": "BID",
        "id": "99066"
      },
      {
        "date": "2017-07-11T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-004917"
      },
      {
        "date": "2017-06-30T11:11:11",
        "db": "PACKETSTORM",
        "id": "143216"
      },
      {
        "date": "2017-06-21T19:29:00.277000",
        "db": "NVD",
        "id": "CVE-2017-6043"
      },
      {
        "date": "2017-06-20T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201706-830"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-07-03T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2017-10707"
      },
      {
        "date": "2017-06-13T00:00:00",
        "db": "BID",
        "id": "99066"
      },
      {
        "date": "2017-07-11T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-004917"
      },
      {
        "date": "2019-10-09T23:28:37.607000",
        "db": "NVD",
        "id": "CVE-2017-6043"
      },
      {
        "date": "2019-10-17T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201706-830"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-830"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Trihedral VTScada Denial of service vulnerability",
    "sources": [
      {
        "db": "IVD",
        "id": "a084bafc-df0b-469d-85a8-46c98d18dce9"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-10707"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Resource management error",
    "sources": [
      {
        "db": "IVD",
        "id": "a084bafc-df0b-469d-85a8-46c98d18dce9"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-830"
      }
    ],
    "trust": 0.8
  }
}

VAR-201711-0416

Vulnerability from variot - Updated: 2023-12-18 12:19

An Uncontrolled Search Path Element issue was discovered in Trihedral VTScada 11.3.03 and prior. The program will execute specially crafted malicious dll files placed on the target machine. Trihedral VTScada Contains a vulnerability related to uncontrolled search path elements.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Trihedral VTScada (formerly known as VTS) is a SCADA system based on the Windows platform provided by Trihedral Engineering of Canada. There are multiple vulnerabilities in Trihedral Engineering Limited VTScada. An attacker could execute arbitrary script code in an affected application or bypass an security restriction to perform an unauthorized operation

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201711-0416",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "engineering limited vtscada",
        "scope": "eq",
        "trust": 1.1,
        "vendor": "trihedral",
        "version": "11.3.2"
      },
      {
        "model": "vtscada",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "trihedral",
        "version": "11.3.03"
      },
      {
        "model": "engineering limited vtscada",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "trihedral",
        "version": "11.3.3"
      },
      {
        "model": "vtscada",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "trihedral engineering",
        "version": "11.3.03"
      },
      {
        "model": "engineering limited vtscada",
        "scope": "lte",
        "trust": 0.6,
        "vendor": "trihedral",
        "version": "\u003c=11.3.03"
      },
      {
        "model": "vtscada",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "trihedral",
        "version": "11.3.03"
      },
      {
        "model": "engineering limited vtscada",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "11.3.5"
      },
      {
        "model": "engineering limited vtscada",
        "scope": "eq",
        "trust": 0.2,
        "vendor": "trihedral",
        "version": "11.3.3*"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "vtscada",
        "version": "*"
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "e2f8ae50-39ab-11e9-bd77-000c29342cb1"
      },
      {
        "db": "IVD",
        "id": "c562c215-19e3-4491-81b1-bb0f615e15c7"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-16270"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-32170"
      },
      {
        "db": "BID",
        "id": "101629"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-009927"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-14029"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201708-1246"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:trihedral:vtscada:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "11.3.03",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-14029"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Karn Ganeshen and Mark Cross.",
    "sources": [
      {
        "db": "BID",
        "id": "101629"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2017-14029",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.3,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 8.6,
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "HIGH",
            "trust": 1.0,
            "userInteractionRequired": true,
            "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Medium",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Complete",
            "baseScore": 9.3,
            "confidentialityImpact": "Complete",
            "exploitabilityScore": null,
            "id": "CVE-2017-14029",
            "impactScore": null,
            "integrityImpact": "Complete",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "CNVD-2018-16270",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.2,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 3.9,
            "id": "CNVD-2017-32170",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "IVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "e2f8ae50-39ab-11e9-bd77-000c29342cb1",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.2,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.9 [IVD]"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "IVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.2,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 3.9,
            "id": "c562c215-19e3-4491-81b1-bb0f615e15c7",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.2,
            "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.9 [IVD]"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "author": "NVD",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.8,
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Local",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 7.8,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2017-14029",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "Required",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2017-14029",
            "trust": 1.8,
            "value": "HIGH"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2018-16270",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2017-32170",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201708-1246",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "IVD",
            "id": "e2f8ae50-39ab-11e9-bd77-000c29342cb1",
            "trust": 0.2,
            "value": "HIGH"
          },
          {
            "author": "IVD",
            "id": "c562c215-19e3-4491-81b1-bb0f615e15c7",
            "trust": 0.2,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "e2f8ae50-39ab-11e9-bd77-000c29342cb1"
      },
      {
        "db": "IVD",
        "id": "c562c215-19e3-4491-81b1-bb0f615e15c7"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-16270"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-32170"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-009927"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-14029"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201708-1246"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "An Uncontrolled Search Path Element issue was discovered in Trihedral VTScada 11.3.03 and prior. The program will execute specially crafted malicious dll files placed on the target machine. Trihedral VTScada Contains a vulnerability related to uncontrolled search path elements.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Trihedral VTScada (formerly known as VTS) is a SCADA system based on the Windows platform provided by Trihedral Engineering of Canada. There are multiple vulnerabilities in Trihedral Engineering Limited VTScada. An attacker could execute arbitrary script code in an affected application or bypass an security restriction to perform an unauthorized operation",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-14029"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-009927"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-16270"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-32170"
      },
      {
        "db": "BID",
        "id": "101629"
      },
      {
        "db": "IVD",
        "id": "e2f8ae50-39ab-11e9-bd77-000c29342cb1"
      },
      {
        "db": "IVD",
        "id": "c562c215-19e3-4491-81b1-bb0f615e15c7"
      }
    ],
    "trust": 3.33
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "ICS CERT",
        "id": "ICSA-17-304-02",
        "trust": 3.3
      },
      {
        "db": "NVD",
        "id": "CVE-2017-14029",
        "trust": 3.2
      },
      {
        "db": "BID",
        "id": "101629",
        "trust": 0.9
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-16270",
        "trust": 0.8
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-32170",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201708-1246",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-009927",
        "trust": 0.8
      },
      {
        "db": "IVD",
        "id": "E2F8AE50-39AB-11E9-BD77-000C29342CB1",
        "trust": 0.2
      },
      {
        "db": "IVD",
        "id": "C562C215-19E3-4491-81B1-BB0F615E15C7",
        "trust": 0.2
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "e2f8ae50-39ab-11e9-bd77-000c29342cb1"
      },
      {
        "db": "IVD",
        "id": "c562c215-19e3-4491-81b1-bb0f615e15c7"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-16270"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-32170"
      },
      {
        "db": "BID",
        "id": "101629"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-009927"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-14029"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201708-1246"
      }
    ]
  },
  "id": "VAR-201711-0416",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "IVD",
        "id": "e2f8ae50-39ab-11e9-bd77-000c29342cb1"
      },
      {
        "db": "IVD",
        "id": "c562c215-19e3-4491-81b1-bb0f615e15c7"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-16270"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-32170"
      }
    ],
    "trust": 2.3460526350000004
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 1.6
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "e2f8ae50-39ab-11e9-bd77-000c29342cb1"
      },
      {
        "db": "IVD",
        "id": "c562c215-19e3-4491-81b1-bb0f615e15c7"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-16270"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-32170"
      }
    ]
  },
  "last_update_date": "2023-12-18T12:19:20.809000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Moving to the Current Version",
        "trust": 0.8,
        "url": "https://www.trihedral.com/help/content/op_welcome/wel_upgradenotes.htm"
      },
      {
        "title": "Trihedral Engineering Limited VTScada ICSA-17-304-0 patch with multiple vulnerabilities",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchinfo/show/137735"
      },
      {
        "title": "Trihedral Engineering Limited VTScada DLL hijacking vulnerability patch",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchinfo/show/105112"
      },
      {
        "title": "Trihedral VTScada Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=100009"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-16270"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-32170"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-009927"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201708-1246"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-427",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-009927"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-14029"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.3,
        "url": "https://ics-cert.us-cert.gov/advisories/icsa-17-304-02"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-14029"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-14029"
      },
      {
        "trust": 0.6,
        "url": "http://www.securityfocus.com/bid/101629"
      },
      {
        "trust": 0.3,
        "url": "www.trihedral.com"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-16270"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-32170"
      },
      {
        "db": "BID",
        "id": "101629"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-009927"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-14029"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201708-1246"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "IVD",
        "id": "e2f8ae50-39ab-11e9-bd77-000c29342cb1"
      },
      {
        "db": "IVD",
        "id": "c562c215-19e3-4491-81b1-bb0f615e15c7"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-16270"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-32170"
      },
      {
        "db": "BID",
        "id": "101629"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-009927"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-14029"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201708-1246"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-08-27T00:00:00",
        "db": "IVD",
        "id": "e2f8ae50-39ab-11e9-bd77-000c29342cb1"
      },
      {
        "date": "2017-11-01T00:00:00",
        "db": "IVD",
        "id": "c562c215-19e3-4491-81b1-bb0f615e15c7"
      },
      {
        "date": "2018-08-27T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2018-16270"
      },
      {
        "date": "2017-11-01T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2017-32170"
      },
      {
        "date": "2017-10-31T00:00:00",
        "db": "BID",
        "id": "101629"
      },
      {
        "date": "2017-11-29T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-009927"
      },
      {
        "date": "2017-11-06T22:29:00.350000",
        "db": "NVD",
        "id": "CVE-2017-14029"
      },
      {
        "date": "2017-08-31T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201708-1246"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-08-27T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2018-16270"
      },
      {
        "date": "2017-11-01T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2017-32170"
      },
      {
        "date": "2017-12-19T22:36:00",
        "db": "BID",
        "id": "101629"
      },
      {
        "date": "2017-11-29T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-009927"
      },
      {
        "date": "2019-10-09T23:23:46",
        "db": "NVD",
        "id": "CVE-2017-14029"
      },
      {
        "date": "2019-10-17T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201708-1246"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "local",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201708-1246"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Trihedral Engineering Limited VTScada DLL Hijacking vulnerability",
    "sources": [
      {
        "db": "IVD",
        "id": "c562c215-19e3-4491-81b1-bb0f615e15c7"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-32170"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Code problem",
    "sources": [
      {
        "db": "IVD",
        "id": "c562c215-19e3-4491-81b1-bb0f615e15c7"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201708-1246"
      }
    ],
    "trust": 0.8
  }
}

VAR-201711-0417

Vulnerability from variot - Updated: 2023-12-18 12:19

An Improper Access Control issue was discovered in Trihedral VTScada 11.3.03 and prior. A local, non-administrator user has privileges to read and write to the file system of the target machine. Trihedral VTScada Contains an access control vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Trihedral VTScada (formerly known as VTS) is a SCADA system based on the Windows platform provided by Trihedral Engineering of Canada. There are multiple vulnerabilities in Trihedral Engineering Limited VTScada. An attacker could execute arbitrary script code in an affected application or bypass an security restriction to perform an unauthorized operation

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201711-0417",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "engineering limited vtscada",
        "scope": "eq",
        "trust": 1.1,
        "vendor": "trihedral",
        "version": "11.3.2"
      },
      {
        "model": "vtscada",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "trihedral",
        "version": "11.3.03"
      },
      {
        "model": "engineering limited vtscada",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "trihedral",
        "version": "11.3.3"
      },
      {
        "model": "vtscada",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "trihedral engineering",
        "version": "11.3.03"
      },
      {
        "model": "engineering limited vtscada",
        "scope": "lte",
        "trust": 0.6,
        "vendor": "trihedral",
        "version": "\u003c=11.3.03"
      },
      {
        "model": "vtscada",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "trihedral",
        "version": "11.3.03"
      },
      {
        "model": "engineering limited vtscada",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "trihedral",
        "version": "11.3.5"
      },
      {
        "model": "engineering limited vtscada",
        "scope": "eq",
        "trust": 0.2,
        "vendor": "trihedral",
        "version": "11.3.3*"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "vtscada",
        "version": "*"
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "e2f8ae50-39ab-11e9-bd77-000c29342cb1"
      },
      {
        "db": "IVD",
        "id": "66d3ee10-0a24-4ce8-81cf-5e3f113a7cb2"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-16270"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-32169"
      },
      {
        "db": "BID",
        "id": "101629"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-009928"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-14031"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201708-1244"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:trihedral:vtscada:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "11.3.03",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-14031"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Karn Ganeshen and Mark Cross.",
    "sources": [
      {
        "db": "BID",
        "id": "101629"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2017-14031",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.2,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 3.9,
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "HIGH",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Local",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Complete",
            "baseScore": 7.2,
            "confidentialityImpact": "Complete",
            "exploitabilityScore": null,
            "id": "CVE-2017-14031",
            "impactScore": null,
            "integrityImpact": "Complete",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "CNVD-2018-16270",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.2,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 3.9,
            "id": "CNVD-2017-32169",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "IVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "e2f8ae50-39ab-11e9-bd77-000c29342cb1",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.2,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.9 [IVD]"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "IVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.2,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 3.9,
            "id": "66d3ee10-0a24-4ce8-81cf-5e3f113a7cb2",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.2,
            "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.9 [IVD]"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "author": "NVD",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.8,
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Local",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 7.8,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2017-14031",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "Low",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2017-14031",
            "trust": 1.8,
            "value": "HIGH"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2018-16270",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2017-32169",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201708-1244",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "IVD",
            "id": "e2f8ae50-39ab-11e9-bd77-000c29342cb1",
            "trust": 0.2,
            "value": "HIGH"
          },
          {
            "author": "IVD",
            "id": "66d3ee10-0a24-4ce8-81cf-5e3f113a7cb2",
            "trust": 0.2,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "e2f8ae50-39ab-11e9-bd77-000c29342cb1"
      },
      {
        "db": "IVD",
        "id": "66d3ee10-0a24-4ce8-81cf-5e3f113a7cb2"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-16270"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-32169"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-009928"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-14031"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201708-1244"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "An Improper Access Control issue was discovered in Trihedral VTScada 11.3.03 and prior. A local, non-administrator user has privileges to read and write to the file system of the target machine. Trihedral VTScada Contains an access control vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Trihedral VTScada (formerly known as VTS) is a SCADA system based on the Windows platform provided by Trihedral Engineering of Canada. There are multiple vulnerabilities in Trihedral Engineering Limited VTScada. An attacker could execute arbitrary script code in an affected application or bypass an security restriction to perform an unauthorized operation",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-14031"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-009928"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-16270"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-32169"
      },
      {
        "db": "BID",
        "id": "101629"
      },
      {
        "db": "IVD",
        "id": "e2f8ae50-39ab-11e9-bd77-000c29342cb1"
      },
      {
        "db": "IVD",
        "id": "66d3ee10-0a24-4ce8-81cf-5e3f113a7cb2"
      }
    ],
    "trust": 3.33
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "ICS CERT",
        "id": "ICSA-17-304-02",
        "trust": 3.3
      },
      {
        "db": "NVD",
        "id": "CVE-2017-14031",
        "trust": 3.2
      },
      {
        "db": "BID",
        "id": "101629",
        "trust": 0.9
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-16270",
        "trust": 0.8
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-32169",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201708-1244",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-009928",
        "trust": 0.8
      },
      {
        "db": "IVD",
        "id": "E2F8AE50-39AB-11E9-BD77-000C29342CB1",
        "trust": 0.2
      },
      {
        "db": "IVD",
        "id": "66D3EE10-0A24-4CE8-81CF-5E3F113A7CB2",
        "trust": 0.2
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "e2f8ae50-39ab-11e9-bd77-000c29342cb1"
      },
      {
        "db": "IVD",
        "id": "66d3ee10-0a24-4ce8-81cf-5e3f113a7cb2"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-16270"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-32169"
      },
      {
        "db": "BID",
        "id": "101629"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-009928"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-14031"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201708-1244"
      }
    ]
  },
  "id": "VAR-201711-0417",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "IVD",
        "id": "e2f8ae50-39ab-11e9-bd77-000c29342cb1"
      },
      {
        "db": "IVD",
        "id": "66d3ee10-0a24-4ce8-81cf-5e3f113a7cb2"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-16270"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-32169"
      }
    ],
    "trust": 2.3460526350000004
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 1.6
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "e2f8ae50-39ab-11e9-bd77-000c29342cb1"
      },
      {
        "db": "IVD",
        "id": "66d3ee10-0a24-4ce8-81cf-5e3f113a7cb2"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-16270"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-32169"
      }
    ]
  },
  "last_update_date": "2023-12-18T12:19:20.762000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Moving to the Current Version",
        "trust": 0.8,
        "url": "https://www.trihedral.com/help/content/op_welcome/wel_upgradenotes.htm"
      },
      {
        "title": "Trihedral Engineering Limited VTScada ICSA-17-304-0 patch with multiple vulnerabilities",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchinfo/show/137735"
      },
      {
        "title": "Trihedral Engineering Limited VTScada does not authorize access to the vulnerability patch",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchinfo/show/105113"
      },
      {
        "title": "Trihedral VTScada Fixes for access control error vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=100007"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-16270"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-32169"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-009928"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201708-1244"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-269",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-284",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-009928"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-14031"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.3,
        "url": "https://ics-cert.us-cert.gov/advisories/icsa-17-304-02"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-14031"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-14031"
      },
      {
        "trust": 0.6,
        "url": "http://www.securityfocus.com/bid/101629"
      },
      {
        "trust": 0.3,
        "url": "www.trihedral.com"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-16270"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-32169"
      },
      {
        "db": "BID",
        "id": "101629"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-009928"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-14031"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201708-1244"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "IVD",
        "id": "e2f8ae50-39ab-11e9-bd77-000c29342cb1"
      },
      {
        "db": "IVD",
        "id": "66d3ee10-0a24-4ce8-81cf-5e3f113a7cb2"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-16270"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-32169"
      },
      {
        "db": "BID",
        "id": "101629"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-009928"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-14031"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201708-1244"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-08-27T00:00:00",
        "db": "IVD",
        "id": "e2f8ae50-39ab-11e9-bd77-000c29342cb1"
      },
      {
        "date": "2017-11-01T00:00:00",
        "db": "IVD",
        "id": "66d3ee10-0a24-4ce8-81cf-5e3f113a7cb2"
      },
      {
        "date": "2018-08-27T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2018-16270"
      },
      {
        "date": "2017-11-01T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2017-32169"
      },
      {
        "date": "2017-10-31T00:00:00",
        "db": "BID",
        "id": "101629"
      },
      {
        "date": "2017-11-29T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-009928"
      },
      {
        "date": "2017-11-06T22:29:00.380000",
        "db": "NVD",
        "id": "CVE-2017-14031"
      },
      {
        "date": "2017-08-31T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201708-1244"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-08-27T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2018-16270"
      },
      {
        "date": "2017-11-01T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2017-32169"
      },
      {
        "date": "2017-12-19T22:36:00",
        "db": "BID",
        "id": "101629"
      },
      {
        "date": "2017-11-29T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-009928"
      },
      {
        "date": "2019-10-09T23:23:46.280000",
        "db": "NVD",
        "id": "CVE-2017-14031"
      },
      {
        "date": "2019-10-17T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201708-1244"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "local",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201708-1244"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Trihedral Engineering Limited VTScada Unauthorized Access Vulnerability",
    "sources": [
      {
        "db": "IVD",
        "id": "66d3ee10-0a24-4ce8-81cf-5e3f113a7cb2"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-32169"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Access control error",
    "sources": [
      {
        "db": "IVD",
        "id": "66d3ee10-0a24-4ce8-81cf-5e3f113a7cb2"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201708-1244"
      }
    ],
    "trust": 0.8
  }
}

CVE-2014-9192 (GCVE-0-2014-9192)

Vulnerability from nvd – Published: 2014-12-11 15:00 – Updated: 2025-07-25 16:46

Title

Trihedral Engineering Limited VTScada Integer Overflow

Summary

Severity

No CVSS data available.

CWE

CWE-190

Assigner

icscert

References

4 references

URL	Tags
https://www.cisa.gov/news-events/ics-advisories/i…
http://www.securityfocus.com/bid/71591	vdb-entryx_refsource_BID
http://www.trihedral.com/help/#Op_Welcome/Wel_Upg…
https://ics-cert.us-cert.gov//advisories/ICSA-14-343-02	x_refsource_MISCx_transferred

Impacted products

1 product

Vendor	Product	Version
Trihedral Engineering	VTS	Affected: 6.5 , < 9.1.19 (custom) Affected: 10 , < 10.2.21 (custom)

Date Public

2014-12-09 07:00

Credits

An anonymous researcher working with HP’s Zero Day Initiative has identified an integer overflow vulnerability in Trihedral Engineering Ltd’s VTScada application.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:40:24.431Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov//advisories/ICSA-14-343-02"
          },
          {
            "name": "71591",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/71591"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "VTS",
          "vendor": "Trihedral Engineering",
          "versions": [
            {
              "lessThan": "9.1.19",
              "status": "affected",
              "version": "6.5",
              "versionType": "custom"
            },
            {
              "lessThan": "10.2.21",
              "status": "affected",
              "version": "10",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "An anonymous researcher working with HP\u2019s Zero Day Initiative has identified an integer overflow vulnerability in Trihedral Engineering Ltd\u2019s VTScada application."
        }
      ],
      "datePublic": "2014-12-09T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eInteger overflow in Trihedral Engineering VTScada (formerly VTS) 6.5 through 9.x before 9.1.20, 10.x before 10.2.22, and 11.x before 11.1.07 allows remote attackers to cause a denial of service (server crash) via a crafted request, which triggers a large memory allocation.\u003c/p\u003e"
            }
          ],
          "value": "Integer overflow in Trihedral Engineering VTScada (formerly VTS) 6.5 through 9.x before 9.1.20, 10.x before 10.2.22, and 11.x before 11.1.07 allows remote attackers to cause a denial of service (server crash) via a crafted request, which triggers a large memory allocation."
        }
      ],
      "metrics": [
        {
          "cvssV2_0": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.8,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
            "version": "2.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-25T16:46:02.667Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-343-02"
        },
        {
          "name": "71591",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/71591"
        },
        {
          "url": "http://www.trihedral.com/help/#Op_Welcome/Wel_UpgradeNotes.htm"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eTrihedral Engineering Limited has created three updated versions of \nsoftware. These software updates are available from Trihedral \nEngineering Ltd.\u2019s FTP site:\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\"\u003eftp://ftp.trihedral.com/VTS/\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eVersion Information:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e11.1.09 \u2013 Latest build including newest features and fixes. Any \ninstallation key with a maintenance expiration date after January 1, \n2014, will work this installation.\u003c/li\u003e\n\u003cli\u003e10.2.22 \u2013Recommended for all users of VTS 10. Any installation key \nwith a maintenance expiration date after December 1, 2010, will work \nwith this installation.\u003c/li\u003e\n\u003cli\u003e09.1.20 \u2013 Recommended for all users prior to 10.0. Any installation \nkey with a maintenance expiration date after December 1, 2009, will work\n with this installation.\u003c/li\u003e\n\u003c/ul\u003e\u003cp\u003eHelp file notes for upgrading VTScada/VTS can be found at:\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://www.trihedral.com/help/#Op_Welcome/Wel_UpgradeNotes.htm\"\u003ehttp://www.trihedral.com/help/#Op_Welcome/Wel_UpgradeNotes.htm\u003c/a\u003e\u003c/p\u003eIf you have any questions or any difficulties with installing one of these updates, please call Trihedral Tech Support:\u003cbr\u003e1-855-887-2232\u003cbr\u003e1-902-835-1575\u003cbr\u003e+44 (0) 1224 258910 for the United Kingdom\n\n\u003cbr\u003e"
            }
          ],
          "value": "Trihedral Engineering Limited has created three updated versions of \nsoftware. These software updates are available from Trihedral \nEngineering Ltd.\u2019s FTP site:\u00a0ftp://ftp.trihedral.com/VTS/\n\n\nVersion Information:\n\n\n\n  *  11.1.09 \u2013 Latest build including newest features and fixes. Any \ninstallation key with a maintenance expiration date after January 1, \n2014, will work this installation.\n\n  *  10.2.22 \u2013Recommended for all users of VTS 10. Any installation key \nwith a maintenance expiration date after December 1, 2010, will work \nwith this installation.\n\n  *  09.1.20 \u2013 Recommended for all users prior to 10.0. Any installation \nkey with a maintenance expiration date after December 1, 2009, will work\n with this installation.\n\n\n\nHelp file notes for upgrading VTScada/VTS can be found at:\u00a0 http://www.trihedral.com/help/#Op_Welcome/Wel_UpgradeNotes.htm \n\nIf you have any questions or any difficulties with installing one of these updates, please call Trihedral Tech Support:\n1-855-887-2232\n1-902-835-1575\n+44 (0) 1224 258910 for the United Kingdom"
        }
      ],
      "source": {
        "advisory": "ICSA-14-343-02",
        "discovery": "EXTERNAL"
      },
      "title": "Trihedral Engineering Limited VTScada Integer Overflow",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2014-9192",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Integer overflow in Trihedral Engineering VTScada (formerly VTS) 6.5 through 9.x before 9.1.20, 10.x before 10.2.22, and 11.x before 11.1.07 allows remote attackers to cause a denial of service (server crash) via a crafted request, which triggers a large memory allocation."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://ics-cert.us-cert.gov//advisories/ICSA-14-343-02",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov//advisories/ICSA-14-343-02"
            },
            {
              "name": "71591",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/71591"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2014-9192",
    "datePublished": "2014-12-11T15:00:00.000Z",
    "dateReserved": "2014-12-02T00:00:00.000Z",
    "dateUpdated": "2025-07-25T16:46:02.667Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-9192 (GCVE-0-2014-9192)

Vulnerability from cvelistv5 – Published: 2014-12-11 15:00 – Updated: 2025-07-25 16:46

Title

Trihedral Engineering Limited VTScada Integer Overflow

Summary

Severity

No CVSS data available.

CWE

CWE-190

Assigner

icscert

References

4 references

URL	Tags
https://www.cisa.gov/news-events/ics-advisories/i…
http://www.securityfocus.com/bid/71591	vdb-entryx_refsource_BID
http://www.trihedral.com/help/#Op_Welcome/Wel_Upg…
https://ics-cert.us-cert.gov//advisories/ICSA-14-343-02	x_refsource_MISCx_transferred

Impacted products

1 product

Vendor	Product	Version
Trihedral Engineering	VTS	Affected: 6.5 , < 9.1.19 (custom) Affected: 10 , < 10.2.21 (custom)

Date Public

2014-12-09 07:00

Credits

An anonymous researcher working with HP’s Zero Day Initiative has identified an integer overflow vulnerability in Trihedral Engineering Ltd’s VTScada application.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:40:24.431Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov//advisories/ICSA-14-343-02"
          },
          {
            "name": "71591",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/71591"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "VTS",
          "vendor": "Trihedral Engineering",
          "versions": [
            {
              "lessThan": "9.1.19",
              "status": "affected",
              "version": "6.5",
              "versionType": "custom"
            },
            {
              "lessThan": "10.2.21",
              "status": "affected",
              "version": "10",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "An anonymous researcher working with HP\u2019s Zero Day Initiative has identified an integer overflow vulnerability in Trihedral Engineering Ltd\u2019s VTScada application."
        }
      ],
      "datePublic": "2014-12-09T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eInteger overflow in Trihedral Engineering VTScada (formerly VTS) 6.5 through 9.x before 9.1.20, 10.x before 10.2.22, and 11.x before 11.1.07 allows remote attackers to cause a denial of service (server crash) via a crafted request, which triggers a large memory allocation.\u003c/p\u003e"
            }
          ],
          "value": "Integer overflow in Trihedral Engineering VTScada (formerly VTS) 6.5 through 9.x before 9.1.20, 10.x before 10.2.22, and 11.x before 11.1.07 allows remote attackers to cause a denial of service (server crash) via a crafted request, which triggers a large memory allocation."
        }
      ],
      "metrics": [
        {
          "cvssV2_0": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.8,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
            "version": "2.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-25T16:46:02.667Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-343-02"
        },
        {
          "name": "71591",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/71591"
        },
        {
          "url": "http://www.trihedral.com/help/#Op_Welcome/Wel_UpgradeNotes.htm"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eTrihedral Engineering Limited has created three updated versions of \nsoftware. These software updates are available from Trihedral \nEngineering Ltd.\u2019s FTP site:\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\"\u003eftp://ftp.trihedral.com/VTS/\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eVersion Information:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e11.1.09 \u2013 Latest build including newest features and fixes. Any \ninstallation key with a maintenance expiration date after January 1, \n2014, will work this installation.\u003c/li\u003e\n\u003cli\u003e10.2.22 \u2013Recommended for all users of VTS 10. Any installation key \nwith a maintenance expiration date after December 1, 2010, will work \nwith this installation.\u003c/li\u003e\n\u003cli\u003e09.1.20 \u2013 Recommended for all users prior to 10.0. Any installation \nkey with a maintenance expiration date after December 1, 2009, will work\n with this installation.\u003c/li\u003e\n\u003c/ul\u003e\u003cp\u003eHelp file notes for upgrading VTScada/VTS can be found at:\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://www.trihedral.com/help/#Op_Welcome/Wel_UpgradeNotes.htm\"\u003ehttp://www.trihedral.com/help/#Op_Welcome/Wel_UpgradeNotes.htm\u003c/a\u003e\u003c/p\u003eIf you have any questions or any difficulties with installing one of these updates, please call Trihedral Tech Support:\u003cbr\u003e1-855-887-2232\u003cbr\u003e1-902-835-1575\u003cbr\u003e+44 (0) 1224 258910 for the United Kingdom\n\n\u003cbr\u003e"
            }
          ],
          "value": "Trihedral Engineering Limited has created three updated versions of \nsoftware. These software updates are available from Trihedral \nEngineering Ltd.\u2019s FTP site:\u00a0ftp://ftp.trihedral.com/VTS/\n\n\nVersion Information:\n\n\n\n  *  11.1.09 \u2013 Latest build including newest features and fixes. Any \ninstallation key with a maintenance expiration date after January 1, \n2014, will work this installation.\n\n  *  10.2.22 \u2013Recommended for all users of VTS 10. Any installation key \nwith a maintenance expiration date after December 1, 2010, will work \nwith this installation.\n\n  *  09.1.20 \u2013 Recommended for all users prior to 10.0. Any installation \nkey with a maintenance expiration date after December 1, 2009, will work\n with this installation.\n\n\n\nHelp file notes for upgrading VTScada/VTS can be found at:\u00a0 http://www.trihedral.com/help/#Op_Welcome/Wel_UpgradeNotes.htm \n\nIf you have any questions or any difficulties with installing one of these updates, please call Trihedral Tech Support:\n1-855-887-2232\n1-902-835-1575\n+44 (0) 1224 258910 for the United Kingdom"
        }
      ],
      "source": {
        "advisory": "ICSA-14-343-02",
        "discovery": "EXTERNAL"
      },
      "title": "Trihedral Engineering Limited VTScada Integer Overflow",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2014-9192",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Integer overflow in Trihedral Engineering VTScada (formerly VTS) 6.5 through 9.x before 9.1.20, 10.x before 10.2.22, and 11.x before 11.1.07 allows remote attackers to cause a denial of service (server crash) via a crafted request, which triggers a large memory allocation."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://ics-cert.us-cert.gov//advisories/ICSA-14-343-02",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov//advisories/ICSA-14-343-02"
            },
            {
              "name": "71591",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/71591"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2014-9192",
    "datePublished": "2014-12-11T15:00:00.000Z",
    "dateReserved": "2014-12-02T00:00:00.000Z",
    "dateUpdated": "2025-07-25T16:46:02.667Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

12 vulnerabilities by Trihedral Engineering

AFFECTED PRODUCTS

IMPACT

VULNERABILITY OVERVIEW

AFFECTED PRODUCTS

IMPACT

VULNERABILITY OVERVIEW

AFFECTED PRODUCTS

IMPACT

CVE-2014-9192 (GCVE-0-2014-9192)

CVE-2014-9192 (GCVE-0-2014-9192)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.