CVE-2023-0621

Published Mar 9, 2023

Last updated 3 months ago

Overview

Description: Cscape Envision RV version 4.60 is vulnerable to an out-of-bounds read vulnerability when parsing project (i.e. HMI) files. The product lacks proper validation of user-supplied data, which could result in reads past the end of allocated data structures. An attacker could leverage these vulnerabilities to execute arbitrary code in the context of the current process.
Source: ics-cert@hq.dhs.gov
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-125

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:hornerautomation:cscape_envision_rv:4.60:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7340C19B-2D32-44A3-BBBB-C7ECFFDC0B61"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References