CVE-2023-0623

Published Mar 9, 2023

Last updated a year ago

Overview

Description: Cscape Envision RV version 4.60 is vulnerable to an out-of-bounds write vulnerability when parsing project (i.e. HMI) files. The product lacks proper validation of user-supplied data, which could result in writes past the end of allocated data structures. An attacker could leverage these vulnerabilities to execute arbitrary code in the context of the current process.
Source: ics-cert@hq.dhs.gov
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:hornerautomation:cscape_envision_rv:4.60:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7340C19B-2D32-44A3-BBBB-C7ECFFDC0B61"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References