Vulnerability-Lookup

VAR-201501-0398

Vulnerability from variot - Updated: 2023-12-18 12:21

Stack-based buffer overflow in Schneider Electric Wonderware InTouch Access Anywhere Server 10.6 and 11.0 allows remote attackers to execute arbitrary code via a request for a filename that does not exist. Schneider Electric provides total solutions for the energy and infrastructure, industrial, data center and network, building and residential markets in more than 100 countries. Attackers can exploit this issue to execute arbitrary code in the context of the affected system. Failed exploit attempts will likely result in denial-of-service conditions. Wonderware InTouch Access Anywhere Server 10.6 and 11.0 are vulnerable; other versions may also be affected. Schneider Electric Wonderware InTouch is an open, scalable HMI and SCADA monitoring solution from Schneider Electric, France, that creates standardized, reusable visualization applications

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201501-0398",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "wonderware intouch access anywhere server",
        "scope": "eq",
        "trust": 2.4,
        "vendor": "schneider electric",
        "version": "10.6"
      },
      {
        "model": "wonderware intouch access anywhere server",
        "scope": "eq",
        "trust": 2.4,
        "vendor": "schneider electric",
        "version": "11.0"
      },
      {
        "model": "electric wonderware intouch access anywhere server",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider",
        "version": "10.6"
      },
      {
        "model": "electric wonderware intouch access anywhere server",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider",
        "version": "11.0"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "wonderware intouch access anywhere server",
        "version": "10.6"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "wonderware intouch access anywhere server",
        "version": "11.0"
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "aad6dba0-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2015-00342"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-007575"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-9190"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201501-201"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:schneider-electric:wonderware_intouch_access_anywhere_server:10.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:schneider-electric:wonderware_intouch_access_anywhere_server:11.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-9190"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The vendor reported this issue.",
    "sources": [
      {
        "db": "BID",
        "id": "71951"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2014-9190",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "HIGH",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Complete",
            "baseScore": 10.0,
            "confidentialityImpact": "Complete",
            "exploitabilityScore": null,
            "id": "CVE-2014-9190",
            "impactScore": null,
            "integrityImpact": "Complete",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "CNVD-2015-00342",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "IVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "aad6dba0-2351-11e6-abef-000c29c66e3d",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.2,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.9 [IVD]"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "VHN-77135",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2014-9190",
            "trust": 1.8,
            "value": "HIGH"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2015-00342",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201501-201",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "IVD",
            "id": "aad6dba0-2351-11e6-abef-000c29c66e3d",
            "trust": 0.2,
            "value": "CRITICAL"
          },
          {
            "author": "VULHUB",
            "id": "VHN-77135",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "aad6dba0-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2015-00342"
      },
      {
        "db": "VULHUB",
        "id": "VHN-77135"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-007575"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-9190"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201501-201"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Stack-based buffer overflow in Schneider Electric Wonderware InTouch Access Anywhere Server 10.6 and 11.0 allows remote attackers to execute arbitrary code via a request for a filename that does not exist. Schneider Electric provides total solutions for the energy and infrastructure, industrial, data center and network, building and residential markets in more than 100 countries. \nAttackers can exploit this issue to execute arbitrary code in the context of the affected system. Failed exploit attempts will likely result in denial-of-service conditions. \nWonderware InTouch Access Anywhere Server 10.6 and 11.0 are vulnerable; other versions may also be affected. Schneider Electric Wonderware InTouch is an open, scalable HMI and SCADA monitoring solution from Schneider Electric, France, that creates standardized, reusable visualization applications",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-9190"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-007575"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2015-00342"
      },
      {
        "db": "BID",
        "id": "71951"
      },
      {
        "db": "IVD",
        "id": "aad6dba0-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "VULHUB",
        "id": "VHN-77135"
      }
    ],
    "trust": 2.7
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2014-9190",
        "trust": 3.6
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-15-008-02",
        "trust": 3.1
      },
      {
        "db": "BID",
        "id": "71951",
        "trust": 1.0
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201501-201",
        "trust": 0.9
      },
      {
        "db": "CNVD",
        "id": "CNVD-2015-00342",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-007575",
        "trust": 0.8
      },
      {
        "db": "IVD",
        "id": "AAD6DBA0-2351-11E6-ABEF-000C29C66E3D",
        "trust": 0.2
      },
      {
        "db": "VULHUB",
        "id": "VHN-77135",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "aad6dba0-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2015-00342"
      },
      {
        "db": "VULHUB",
        "id": "VHN-77135"
      },
      {
        "db": "BID",
        "id": "71951"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-007575"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-9190"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201501-201"
      }
    ]
  },
  "id": "VAR-201501-0398",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "IVD",
        "id": "aad6dba0-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2015-00342"
      },
      {
        "db": "VULHUB",
        "id": "VHN-77135"
      }
    ],
    "trust": 1.775
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "aad6dba0-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2015-00342"
      }
    ]
  },
  "last_update_date": "2023-12-18T12:21:05.159000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Web HMI and Mobile SCADA: Wonderware InTouch Access Anywhere",
        "trust": 0.8,
        "url": "http://software.invensys.com/products/wonderware/hmi-and-supervisory-control/intouch-access-anywhere/"
      },
      {
        "title": "Schneider Electric Wonderware InTouch Access Anywhere Server Buffer Overflow Vulnerability Patch",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchinfo/show/53978"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2015-00342"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-007575"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-119",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-77135"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-007575"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-9190"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.1,
        "url": "https://ics-cert.us-cert.gov/advisories/icsa-15-008-02"
      },
      {
        "trust": 1.7,
        "url": "https://wdnresource.wonderware.com/support/docs/_securitybulletins/security_bulletin_lfsec00000104.pdf"
      },
      {
        "trust": 1.4,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-9190"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-9190"
      },
      {
        "trust": 0.6,
        "url": "http://www.securityfocus.com/bid/71951/"
      },
      {
        "trust": 0.3,
        "url": "http://www.schneider-electric.com/site/home/index.cfm/ww/?selectcountry=true"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2015-00342"
      },
      {
        "db": "VULHUB",
        "id": "VHN-77135"
      },
      {
        "db": "BID",
        "id": "71951"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-007575"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-9190"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201501-201"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "IVD",
        "id": "aad6dba0-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2015-00342"
      },
      {
        "db": "VULHUB",
        "id": "VHN-77135"
      },
      {
        "db": "BID",
        "id": "71951"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-007575"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-9190"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201501-201"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2015-01-15T00:00:00",
        "db": "IVD",
        "id": "aad6dba0-2351-11e6-abef-000c29c66e3d"
      },
      {
        "date": "2015-01-15T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2015-00342"
      },
      {
        "date": "2015-01-10T00:00:00",
        "db": "VULHUB",
        "id": "VHN-77135"
      },
      {
        "date": "2015-01-08T00:00:00",
        "db": "BID",
        "id": "71951"
      },
      {
        "date": "2015-01-14T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-007575"
      },
      {
        "date": "2015-01-10T02:59:33.693000",
        "db": "NVD",
        "id": "CVE-2014-9190"
      },
      {
        "date": "2015-01-12T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201501-201"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2015-01-15T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2015-00342"
      },
      {
        "date": "2015-01-12T00:00:00",
        "db": "VULHUB",
        "id": "VHN-77135"
      },
      {
        "date": "2015-03-19T08:13:00",
        "db": "BID",
        "id": "71951"
      },
      {
        "date": "2015-01-14T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-007575"
      },
      {
        "date": "2015-01-12T21:34:14.610000",
        "db": "NVD",
        "id": "CVE-2014-9190"
      },
      {
        "date": "2015-01-21T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201501-201"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201501-201"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Schneider Electric Wonderware InTouch Access Anywhere Server Buffer Overflow Vulnerability",
    "sources": [
      {
        "db": "IVD",
        "id": "aad6dba0-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2015-00342"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Buffer overflow",
    "sources": [
      {
        "db": "IVD",
        "id": "aad6dba0-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201501-201"
      }
    ],
    "trust": 0.8
  }
}

CVE-2014-9190 (GCVE-0-2014-9190)

Vulnerability from cvelistv5 – Published: 2015-01-10 02:00 – Updated: 2025-07-24 22:42

Title

Schneider Electric Wonderware InTouch Access Anywhere Server Buffer Overflow

Summary

Severity ?

No CVSS data available.

CWE

CWE-121

Assigner

icscert

References

URL

Tags

	https://wdnresource.wonderware.com/support/docs/_…	x_refsource_CONFIRM
	https://www.cisa.gov/news-events/ics-advisories/i…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Schneider Electric	InTouch Access Anywhere Server	Affected: 10.6 Affected: 11.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:40:24.643Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://wdnresource.wonderware.com/support/docs/_SecurityBulletins/Security_Bulletin_LFSEC00000104.pdf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSA-15-008-02"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "InTouch Access Anywhere Server",
          "vendor": "Schneider Electric",
          "versions": [
            {
              "status": "affected",
              "version": "10.6"
            },
            {
              "status": "affected",
              "version": "11.0"
            }
          ]
        }
      ],
      "datePublic": "2015-01-08T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eStack-based buffer overflow in Schneider Electric Wonderware InTouch Access Anywhere Server 10.6 and 11.0 allows remote attackers to execute arbitrary code via a request for a filename that does not exist.\u003c/p\u003e"
            }
          ],
          "value": "Stack-based buffer overflow in Schneider Electric Wonderware InTouch Access Anywhere Server 10.6 and 11.0 allows remote attackers to execute arbitrary code via a request for a filename that does not exist."
        }
      ],
      "metrics": [
        {
          "cvssV2_0": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-24T22:42:57.203Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://wdnresource.wonderware.com/support/docs/_SecurityBulletins/Security_Bulletin_LFSEC00000104.pdf"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-15-008-02"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSchneider Electric has released a security update that mitigates the \nstack-based buffer overflow vulnerability in Wonderware\u2019s InTouch Access\n Anywhere Server product, Versions 10.6 and 11.0. Schneider Electric\u2019s \nsecurity updates for Version 10.6 and Version 11.0 are available at the \nfollowing location with a user account:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://wdnresource.wonderware.com/tracking/confirmdownload.aspx?id=3001\u0026amp;url=https://wdnresource.wonderware.com/support/patchfixes/1/WW-ITAA2014P01-LFSEC104.zip\u0026amp;rme=https://wdnresource.wonderware.com/support/patchfixes/1/WW-ITAA2014P01-LFSEC104.txt\"\u003ehttps://wdnresource.wonderware.com/tracking/confirmdownload.aspx?id=3001\u0026amp;url=https://wdnresource...\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eSchneider Electric has released a security bulletin titled \u201cInTouch \nAccess Anywhere Server Security Vulnerability, LFSEC00000104\u201d to \nannounce the security update, which is available at the following \nlocation:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gcsresource.invensys.com/support/docs/_SecurityBulletins/Security_Bulletin_LFSEC00000104.pdf\"\u003ehttps://gcsresource.invensys.com/support/docs/_SecurityBulletins/Security_Bulletin_LFSEC00000104.pdf\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Schneider Electric has released a security update that mitigates the \nstack-based buffer overflow vulnerability in Wonderware\u2019s InTouch Access\n Anywhere Server product, Versions 10.6 and 11.0. Schneider Electric\u2019s \nsecurity updates for Version 10.6 and Version 11.0 are available at the \nfollowing location with a user account:\n\n\n https://wdnresource.wonderware.com/tracking/confirmdownload.aspx?id=3001\u0026url=https://wdnresource... https://wdnresource.wonderware.com/tracking/confirmdownload.aspx \n\n\nSchneider Electric has released a security bulletin titled \u201cInTouch \nAccess Anywhere Server Security Vulnerability, LFSEC00000104\u201d to \nannounce the security update, which is available at the following \nlocation:\n\n\n https://gcsresource.invensys.com/support/docs/_SecurityBulletins/Security_Bulletin_LFSEC00000104.pdf"
        }
      ],
      "source": {
        "advisory": "ICSA-15-008-02",
        "discovery": "INTERNAL"
      },
      "title": "Schneider Electric Wonderware InTouch Access Anywhere Server Buffer Overflow",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2014-9190",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Stack-based buffer overflow in Schneider Electric Wonderware InTouch Access Anywhere Server 10.6 and 11.0 allows remote attackers to execute arbitrary code via a request for a filename that does not exist."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wdnresource.wonderware.com/support/docs/_SecurityBulletins/Security_Bulletin_LFSEC00000104.pdf",
              "refsource": "CONFIRM",
              "url": "https://wdnresource.wonderware.com/support/docs/_SecurityBulletins/Security_Bulletin_LFSEC00000104.pdf"
            },
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSA-15-008-02",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSA-15-008-02"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2014-9190",
    "datePublished": "2015-01-10T02:00:00",
    "dateReserved": "2014-12-02T00:00:00",
    "dateUpdated": "2025-07-24T22:42:57.203Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

VAR-201501-0398

CVE-2014-9190 (GCVE-0-2014-9190)

Tags

Sightings

Nomenclature