variot - var-201404-0553

VAR-201404-0553

Vulnerability from variot - Updated: 2023-12-18 12:45

Multiple buffer overflows in the OPC Automation 2.0 Server Object ActiveX control in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 3.5 and earlier, TLXCDSTOFS33 3.5 and earlier, TLXCDLUOFS33 3.5 and earlier, TLXCDLTOFS33 3.5 and earlier, and TLXCDLFOFS33 3.5 and earlier allow remote attackers to cause a denial of service via long arguments to unspecified functions. Schneider Electric provides total solutions for the energy and infrastructure, industrial, data center and network, building and residential markets in more than 100 countries. Zone overflow vulnerability. Allowing a remote attacker to cause a denial of service through the \342\200\230long\342\200\231 parameter. Multiple Schneider Electric Products are prone to a remote buffer-overflow vulnerability because it fails to properly validate user-supplied input. Attackers can exploit this issue to cause a denial-of-service condition. The following products are vulnerable: TLXCDSUOFS33 3.5 and prior TLXCDSTOFS33 3.5 and prior TLXCDLUOFS33 3.5 and prior TLXCDLTOFS33 3.5 and prior TLXCDLFOFS33 3.5 and prior. The application features easy integration, custom interface and more

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201404-0553",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "opc factory server tlxcdltofs",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "schneider electric",
        "version": "3.35"
      },
      {
        "model": "opc factory server tlxcdsuofs",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "schneider electric",
        "version": "3.35"
      },
      {
        "model": "opc factory server tlxcdluofs",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "schneider electric",
        "version": "3.35"
      },
      {
        "model": "opc factory server tlxcdstofs",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "schneider electric",
        "version": "3.35"
      },
      {
        "model": "opc factory server tlxcdlfofs",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "schneider electric",
        "version": "3.35"
      },
      {
        "model": "tlxcdlfofs",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "schneider electric",
        "version": "33 - v3.5"
      },
      {
        "model": "tlxcdltofs",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "schneider electric",
        "version": "33 - v3.5"
      },
      {
        "model": "tlxcdluofs",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "schneider electric",
        "version": "33 - v3.5"
      },
      {
        "model": "tlxcdstofs",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "schneider electric",
        "version": "33 - v3.5"
      },
      {
        "model": "tlxcdsuofs",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "schneider electric",
        "version": "33 - v3.5"
      },
      {
        "model": "electric tlxcdsuofs33",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider",
        "version": "3.5"
      },
      {
        "model": "electric tlxcdstofs33",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider",
        "version": "3.5"
      },
      {
        "model": "electric tlxcdluofs33",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider",
        "version": "3.5"
      },
      {
        "model": "electric tlxcdlfofs33",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider",
        "version": "3.5"
      },
      {
        "model": "opc factory server tlxcdluofs",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider electric",
        "version": "3.35"
      },
      {
        "model": "opc factory server tlxcdstofs",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider electric",
        "version": "3.35"
      },
      {
        "model": "opc factory server tlxcdlfofs",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider electric",
        "version": "3.35"
      },
      {
        "model": "opc factory server tlxcdsuofs",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider electric",
        "version": "3.35"
      },
      {
        "model": "opc factory server tlxcdltofs",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider electric",
        "version": "3.35"
      },
      {
        "model": "opc factory server tlxcdsuofs33",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "schneider electric",
        "version": "3.5"
      },
      {
        "model": "opc factory server tlxcdstofs33",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "schneider electric",
        "version": "3.5"
      },
      {
        "model": "opc factory server tlxcdluofs33",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "schneider electric",
        "version": "3.5"
      },
      {
        "model": "opc factory server tlxcdltofs33",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "schneider electric",
        "version": "3.5"
      },
      {
        "model": "opc factory server tlxcdlfofs33",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "schneider electric",
        "version": "3.5"
      },
      {
        "model": "opc factory server sp1",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "schneider electric",
        "version": "3.5"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "opc factory server tlxcdlfofs",
        "version": "*"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "opc factory server tlxcdltofs",
        "version": "*"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "opc factory server tlxcdluofs",
        "version": "*"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "opc factory server tlxcdstofs",
        "version": "*"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "opc factory server tlxcdsuofs",
        "version": "*"
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "1ab16a62-2352-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-02181"
      },
      {
        "db": "BID",
        "id": "66643"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001905"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0789"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201404-058"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:h:schneider-electric:opc_factory_server_tlxcdstofs:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "3.35",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:schneider-electric:opc_factory_server_tlxcdltofs:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "3.35",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:schneider-electric:opc_factory_server_tlxcdluofs:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "3.35",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:schneider-electric:opc_factory_server_tlxcdlfofs:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "3.35",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:schneider-electric:opc_factory_server_tlxcdsuofs:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "3.35",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-0789"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Wei Gao",
    "sources": [
      {
        "db": "BID",
        "id": "66643"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2014-0789",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.8,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "impactScore": 6.9,
            "integrityImpact": "NONE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "HIGH",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Complete",
            "baseScore": 7.8,
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2014-0789",
            "impactScore": null,
            "integrityImpact": "None",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.8,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "CNVD-2014-02181",
            "impactScore": 6.9,
            "integrityImpact": "NONE",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "IVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.8,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "1ab16a62-2352-11e6-abef-000c29c66e3d",
            "impactScore": 6.9,
            "integrityImpact": "NONE",
            "severity": "HIGH",
            "trust": 0.2,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
            "version": "2.9 [IVD]"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.8,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "VHN-68282",
            "impactScore": 6.9,
            "integrityImpact": "NONE",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2014-0789",
            "trust": 1.8,
            "value": "HIGH"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2014-02181",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201404-058",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "IVD",
            "id": "1ab16a62-2352-11e6-abef-000c29c66e3d",
            "trust": 0.2,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-68282",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "1ab16a62-2352-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-02181"
      },
      {
        "db": "VULHUB",
        "id": "VHN-68282"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001905"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0789"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201404-058"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Multiple buffer overflows in the OPC Automation 2.0 Server Object ActiveX control in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 3.5 and earlier, TLXCDSTOFS33 3.5 and earlier, TLXCDLUOFS33 3.5 and earlier, TLXCDLTOFS33 3.5 and earlier, and TLXCDLFOFS33 3.5 and earlier allow remote attackers to cause a denial of service via long arguments to unspecified functions. Schneider Electric provides total solutions for the energy and infrastructure, industrial, data center and network, building and residential markets in more than 100 countries. Zone overflow vulnerability. Allowing a remote attacker to cause a denial of service through the \\342\\200\\230long\\342\\200\\231 parameter. Multiple Schneider Electric Products are prone to a remote buffer-overflow vulnerability because it fails to properly validate user-supplied input. \nAttackers can exploit this issue to cause a denial-of-service condition. \nThe following products are vulnerable:\nTLXCDSUOFS33 3.5 and prior\nTLXCDSTOFS33 3.5 and prior\nTLXCDLUOFS33 3.5 and prior\nTLXCDLTOFS33 3.5 and prior\nTLXCDLFOFS33 3.5 and prior. The application features easy integration, custom interface and more",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-0789"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001905"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-02181"
      },
      {
        "db": "BID",
        "id": "66643"
      },
      {
        "db": "IVD",
        "id": "1ab16a62-2352-11e6-abef-000c29c66e3d"
      },
      {
        "db": "VULHUB",
        "id": "VHN-68282"
      }
    ],
    "trust": 2.7
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2014-0789",
        "trust": 3.6
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-14-093-01",
        "trust": 2.8
      },
      {
        "db": "BID",
        "id": "66643",
        "trust": 1.0
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201404-058",
        "trust": 0.9
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-02181",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001905",
        "trust": 0.8
      },
      {
        "db": "IVD",
        "id": "1AB16A62-2352-11E6-ABEF-000C29C66E3D",
        "trust": 0.2
      },
      {
        "db": "VULHUB",
        "id": "VHN-68282",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "1ab16a62-2352-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-02181"
      },
      {
        "db": "VULHUB",
        "id": "VHN-68282"
      },
      {
        "db": "BID",
        "id": "66643"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001905"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0789"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201404-058"
      }
    ]
  },
  "id": "VAR-201404-0553",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "IVD",
        "id": "1ab16a62-2352-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-02181"
      },
      {
        "db": "VULHUB",
        "id": "VHN-68282"
      }
    ],
    "trust": 1.9
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "1ab16a62-2352-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-02181"
      }
    ]
  },
  "last_update_date": "2023-12-18T12:45:21.813000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Vulnerability Disclosure - OPC Factory Server Buffer Overflow (SEVD 2014-084-01)",
        "trust": 0.8,
        "url": "http://download.schneider-electric.com/files?p_doc_ref=sevd%202014-084-01"
      },
      {
        "title": "Cybersecurity News",
        "trust": 0.8,
        "url": "http://www.schneider-electric.com/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/content/news/data/en/local/cybersecurity/general_information/2014/03/20140325_vulnerability_disclosure_opc_factory_server.xml"
      },
      {
        "title": "Patch for multiple Schneider Electric product heap buffer overflow vulnerabilities",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchinfo/show/44691"
      },
      {
        "title": "OFS_CD2906_V350_SP1",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=49093"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-02181"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001905"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201404-058"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-119",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-68282"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001905"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0789"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.8,
        "url": "http://ics-cert.us-cert.gov/advisories/icsa-14-093-01"
      },
      {
        "trust": 1.7,
        "url": "http://www.schneider-electric.com/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/content/news/data/en/local/cybersecurity/general_information/2014/03/20140325_vulnerability_disclosure_opc_factory_server.xml"
      },
      {
        "trust": 1.4,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-0789"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0789"
      },
      {
        "trust": 0.6,
        "url": "http://www.securityfocus.com/bid/66643"
      },
      {
        "trust": 0.3,
        "url": "http://chemical-facility-security-news.blogspot.com/2014/04/yet-another-schneider-advisory-from-ics.html"
      },
      {
        "trust": 0.3,
        "url": "http://www.schneider-electric.com/site/home/index.cfm/ww/?selectcountry=true"
      },
      {
        "trust": 0.3,
        "url": "http://www2.schneider-electric.com/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/content/news/data/en/local/cybersecurity/general_information/2014/03/20140325_vulnerabil"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-02181"
      },
      {
        "db": "VULHUB",
        "id": "VHN-68282"
      },
      {
        "db": "BID",
        "id": "66643"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001905"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0789"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201404-058"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "IVD",
        "id": "1ab16a62-2352-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-02181"
      },
      {
        "db": "VULHUB",
        "id": "VHN-68282"
      },
      {
        "db": "BID",
        "id": "66643"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001905"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0789"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201404-058"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-04-10T00:00:00",
        "db": "IVD",
        "id": "1ab16a62-2352-11e6-abef-000c29c66e3d"
      },
      {
        "date": "2014-04-09T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2014-02181"
      },
      {
        "date": "2014-04-04T00:00:00",
        "db": "VULHUB",
        "id": "VHN-68282"
      },
      {
        "date": "2014-03-25T00:00:00",
        "db": "BID",
        "id": "66643"
      },
      {
        "date": "2014-04-07T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-001905"
      },
      {
        "date": "2014-04-04T15:09:45.917000",
        "db": "NVD",
        "id": "CVE-2014-0789"
      },
      {
        "date": "2014-04-09T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201404-058"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-04-10T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2014-02181"
      },
      {
        "date": "2014-04-04T00:00:00",
        "db": "VULHUB",
        "id": "VHN-68282"
      },
      {
        "date": "2014-03-25T00:00:00",
        "db": "BID",
        "id": "66643"
      },
      {
        "date": "2014-04-07T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-001905"
      },
      {
        "date": "2014-04-04T17:52:48.090000",
        "db": "NVD",
        "id": "CVE-2014-0789"
      },
      {
        "date": "2014-04-09T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201404-058"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201404-058"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "plural  Schneider Electric OPC Factory Server Product buffer overflow vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001905"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Buffer overflow",
    "sources": [
      {
        "db": "IVD",
        "id": "1ab16a62-2352-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201404-058"
      }
    ],
    "trust": 0.8
  }
}

CVE-2014-0789 (GCVE-0-2014-0789)

Vulnerability from cvelistv5 – Published: 2014-04-04 15:00 – Updated: 2025-09-25 17:45

Summary

Severity ?

No CVSS data available.

CWE

CWE-122

Assigner

icscert

References

URL

Tags

	https://www.cisa.gov/news-events/ics-advisories/i…
	http://www.schneider-electric.com/corporate/en/su…	x_refsource_CONFIRM
	http://www2.schneider-electric.com/sites/corporat…

Impacted products

	Vendor	Product	Version
	Schneider Electric	OPC Factory Server (OFS)	Affected: 0 , ≤ TLXCDSUOFS33 – V3.5 (custom) Affected: 0 , ≤ TLXCDSTOFS33 – V3.5 (custom) Affected: 0 , ≤ TLXCDLUOFS33 – V3.5 (custom) Affected: 0 , ≤ TLXCDLTOFS33 – V3.5 (custom) Affected: 0 , ≤ TLXCDLFOFS33 – V3.5 (custom)

Credits

Wei Gao, formerly of IXIA

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T09:27:19.528Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-093-01"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.schneider-electric.com/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/Content/News/data/en/local/cybersecurity/general_information/2014/03/20140325_vulnerability_disclosure_opc_factory_server.xml"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OPC Factory Server (OFS)",
          "vendor": "Schneider Electric",
          "versions": [
            {
              "lessThanOrEqual": "TLXCDSUOFS33 \u2013 V3.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "TLXCDSTOFS33 \u2013 V3.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "TLXCDLUOFS33 \u2013 V3.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "TLXCDLTOFS33 \u2013 V3.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "TLXCDLFOFS33 \u2013 V3.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wei Gao, formerly of IXIA"
        }
      ],
      "datePublic": "2014-04-03T06:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMultiple buffer overflows in the OPC Automation 2.0 Server Object ActiveX control in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 3.5 and earlier, TLXCDSTOFS33 3.5 and earlier, TLXCDLUOFS33 3.5 and earlier, TLXCDLTOFS33 3.5 and earlier, and TLXCDLFOFS33 3.5 and earlier allow remote attackers to cause a denial of service via long arguments to unspecified functions.\u003c/p\u003e"
            }
          ],
          "value": "Multiple buffer overflows in the OPC Automation 2.0 Server Object ActiveX control in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 3.5 and earlier, TLXCDSTOFS33 3.5 and earlier, TLXCDLUOFS33 3.5 and earlier, TLXCDLTOFS33 3.5 and earlier, and TLXCDLFOFS33 3.5 and earlier allow remote attackers to cause a denial of service via long arguments to unspecified functions."
        }
      ],
      "metrics": [
        {
          "cvssV2_0": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-25T17:45:27.086Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-093-01"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.schneider-electric.com/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/Content/News/data/en/local/cybersecurity/general_information/2014/03/20140325_vulnerability_disclosure_opc_factory_server.xml"
        },
        {
          "url": "http://www2.schneider-electric.com/sites/corporate/en/support/cybersecurity/cybersecurity.page"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSchneider Electric has developed a patch to resolve this issue. In order to patch the installation in the field, install OFS V3.5SP1, available on Schneider Electric\u2019s web site at the following URL:\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://www.schneider-electric.com/download/WW/EN/results/0/0/8336568-OPC-Factory-Server/0/?showAsIframe=true\"\u003ehttp://www.schneider-electric.com/download/WW/EN/results/0/0/8336568-OPC-Factory-Server/0/?showAsIfr...\u003c/a\u003e\u003c/p\u003e\u003cp\u003eOFS V3.5SP1 includes a patched version of the OLE2T macro from Microsoft to resolve the issue.\u003c/p\u003e\u003cp\u003eFor more information regarding this issue, please see the security announcements affecting the OPC Factory Server on Schneider Electric\u2019s web site at the following URL:\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://www2.schneider-electric.com/sites/corporate/en/support/cybersecurity/cybersecurity.page\"\u003ehttp://www2.schneider-electric.com/sites/corporate/en/support/cybersecurity/cybersecurity.page\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Schneider Electric has developed a patch to resolve this issue. In order to patch the installation in the field, install OFS V3.5SP1, available on Schneider Electric\u2019s web site at the following URL:\u00a0 http://www2.schneider-electric.com/sites/corporate/en/support/cybersecurity/cybersecurity.page"
        }
      ],
      "source": {
        "advisory": "ICSA-14-093-01",
        "discovery": "EXTERNAL"
      },
      "title": "Schneider Electric OPC Factory Server Buffer Overflow",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2014-0789",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple buffer overflows in the OPC Automation 2.0 Server Object ActiveX control in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 3.5 and earlier, TLXCDSTOFS33 3.5 and earlier, TLXCDLUOFS33 3.5 and earlier, TLXCDLTOFS33 3.5 and earlier, and TLXCDLFOFS33 3.5 and earlier allow remote attackers to cause a denial of service via long arguments to unspecified functions."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://ics-cert.us-cert.gov/advisories/ICSA-14-093-01",
              "refsource": "MISC",
              "url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-093-01"
            },
            {
              "name": "http://www.schneider-electric.com/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/Content/News/data/en/local/cybersecurity/general_information/2014/03/20140325_vulnerability_disclosure_opc_factory_server.xml",
              "refsource": "CONFIRM",
              "url": "http://www.schneider-electric.com/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/Content/News/data/en/local/cybersecurity/general_information/2014/03/20140325_vulnerability_disclosure_opc_factory_server.xml"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2014-0789",
    "datePublished": "2014-04-04T15:00:00",
    "dateReserved": "2014-01-02T00:00:00",
    "dateUpdated": "2025-09-25T17:45:27.086Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

VAR-201404-0553

CVE-2014-0789 (GCVE-0-2014-0789)

Tags

Sightings

Nomenclature