gsd-2023-5944
Vulnerability from gsd
Modified
2023-12-13 01:20
Details
** UNSUPPPORTED WHEN ASSIGNED ** Delta Electronics DOPSoft is vulnerable to a stack-based buffer overflow, which may allow for arbitrary code execution if an attacker can lead a legitimate user to execute a specially crafted file.
Aliases
Aliases
CVE-2023-5944


To clipboard 

{
  "GSD": {
    "alias": "CVE-2023-5944",
    "id": "GSD-2023-5944"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-5944"
      ],
      "details": "** UNSUPPPORTED WHEN ASSIGNED ** \nDelta Electronics\u00a0DOPSoft is vulnerable to a stack-based buffer overflow, which may allow for arbitrary code execution if an attacker can lead a legitimate user to execute a specially crafted file.\n\n",
      "id": "GSD-2023-5944",
      "modified": "2023-12-13T01:20:50.927678Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "ics-cert@hq.dhs.gov",
        "ID": "CVE-2023-5944",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "DOPSoft",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "All versions "
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Delta Electronics"
            }
          ]
        }
      },
      "credits": [
        {
          "lang": "en",
          "value": "Natnael Samson working with Trend Micro Zero Day"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** UNSUPPPORTED WHEN ASSIGNED ** \nDelta Electronics\u00a0DOPSoft is vulnerable to a stack-based buffer overflow, which may allow for arbitrary code execution if an attacker can lead a legitimate user to execute a specially crafted file.\n\n"
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-121",
                "lang": "eng",
                "value": "CWE-121 Stack-based Buffer Overflow"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-334-01",
            "refsource": "MISC",
            "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-334-01"
          },
          {
            "name": "https://diastudio.deltaww.com/home/downloads?sec=download#catalog",
            "refsource": "MISC",
            "url": "https://diastudio.deltaww.com/home/downloads?sec=download#catalog"
          }
        ]
      },
      "solution": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cp\u003e\nDelta Electronics has declared DOPSoft as end-of-life and recommends users to use DIAScreen instead. \n\n\n\nThis vulnerability does not exist on the newest version of DIAScreen.\u0026nbsp; Users may download the DIAScreen v1.3.1 (or newer) on the \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://diastudio.deltaww.com/home/downloads?sec=download#catalog\"\u003eDIAStudio download center\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "\n\nDelta Electronics has declared DOPSoft as end-of-life and recommends users to use DIAScreen instead. \n\n\n\nThis vulnerability does not exist on the newest version of DIAScreen.\u00a0 Users may download the DIAScreen v1.3.1 (or newer) on the  DIAStudio download center https://diastudio.deltaww.com/home/downloads \n\n\n\n\n"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:deltaww:dopsoft:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9386A747-1745-461E-B7DC-75293A166EC5",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "\nDelta Electronics\u00a0DOPSoft is vulnerable to a stack-based buffer overflow, which may allow for arbitrary code execution if an attacker can lead a legitimate user to execute a specially crafted file.\n\n"
          },
          {
            "lang": "es",
            "value": "Delta Electronics DOPSoft es vulnerable a un desbordamiento del b\u00fafer basado en pila, lo que puede permitir la ejecuci\u00f3n de c\u00f3digo arbitrario si un atacante puede llevar a un usuario leg\u00edtimo a ejecutar un archivo especialmente manipulado."
          }
        ],
        "id": "CVE-2023-5944",
        "lastModified": "2024-04-11T01:23:11.740",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "ics-cert@hq.dhs.gov",
              "type": "Secondary"
            }
          ]
        },
        "published": "2023-12-04T23:15:27.940",
        "references": [
          {
            "source": "ics-cert@hq.dhs.gov",
            "tags": [
              "Permissions Required"
            ],
            "url": "https://diastudio.deltaww.com/home/downloads?sec=download#catalog"
          },
          {
            "source": "ics-cert@hq.dhs.gov",
            "tags": [
              "Third Party Advisory",
              "US Government Resource"
            ],
            "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-334-01"
          }
        ],
        "sourceIdentifier": "ics-cert@hq.dhs.gov",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-121"
              }
            ],
            "source": "ics-cert@hq.dhs.gov",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.