Lucene search

[email protected]CVE-2010-2974

HistoryOct 03, 2022 - 4:21 p.m.

CVE-2010-2974

2022-10-0316:21:09

CWE-119

[email protected]

web.nvd.nist.gov

cve-2010-2974

stack-based buffer overflow

iconfigurationaccess

invensys wonderware

activex control

wonderware application server

remote code execution

nvd

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

8.4 High

AI Score

Confidence

High

0.025 Low

EPSS

Percentile

90.2%

JSON

Stack-based buffer overflow in the IConfigurationAccess interface in the Invensys Wonderware Archestra ConfigurationAccessComponent ActiveX control in Wonderware Application Server (WAS) before 3.1 SP2 P01, as used in the Wonderware Archestra Integrated Development Environment (IDE) and the InFusion Integrated Engineering Environment (IEE), allows remote attackers to execute arbitrary code via the first argument to the UnsubscribeData method.

Affected configurations

NVD

Node

invensyswonderware_archestra_configuration_access_component_activex_control

AND

invensysinfusion_integrated_engineering_environment

invensyswonderware_application_serverRange≤3.1sp2

invensyswonderware_application_serverMatch2.0

invensyswonderware_application_serverMatch2.1

invensyswonderware_application_serverMatch3.0

invensyswonderware_application_serverMatch3.1

invensyswonderware_application_serverMatch3.1sp1

invensyswonderware_archestra_integrated_development_environment

CPENameOperatorVersion
invensys:wonderware_archestra_configuration_access_component_activex_controlinvensys wonderware archestra configuration access component activex controleq*
invensys:wonderware_application_serverinvensys wonderware application serverle3.1
invensys:wonderware_application_serverinvensys wonderware application servereq2.0
invensys:wonderware_application_serverinvensys wonderware application servereq2.1
invensys:wonderware_application_serverinvensys wonderware application servereq3.0

CPE	Name	Operator	Version
invensys:wonderware_archestra_configuration_access_component_activex_control	invensys wonderware archestra configuration access component activex control	eq	*
invensys:wonderware_application_server	invensys wonderware application server	le	3.1
invensys:wonderware_application_server	invensys wonderware application server	eq	2.0
invensys:wonderware_application_server	invensys wonderware application server	eq	2.1
invensys:wonderware_application_server	invensys wonderware application server	eq	3.0

References

www.kb.cert.org/vuls/id/703189

www.kb.cert.org/vuls/id/MORO-87MHPT

www.pacwest.wonderware.com/web/News/NewsDetails.aspx?NewsID=203108

wdnresource.wonderware.com/support/kbcd/html/1/t002492.htm

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

8.4 High

AI Score

Confidence

High

0.025 Low

EPSS

Percentile

90.2%

JSON

Related for CVE-2010-2974

cvelist1 prion1 nvd1 ics1