Lucene search

IcscertCVE-2019-10965

HistoryMay 28, 2019 - 10:29 p.m.

CVE-2019-10965

2019-05-2822:29:00

CWE-787

icscert

web.nvd.nist.gov

cve-2019-10965

emerson ovation

ocr400

controller

ftp server

buffer overflow

memory corruption

remote code execution

privilege escalation

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.007

Percentile

80.9%

JSON

In Emerson Ovation OCR400 Controller 3.3.1 and earlier, a heap-based buffer overflow vulnerability in the embedded third-party FTP server involves improper handling of a long command to the FTP service, which may cause memory corruption that halts the controller or leads to remote code execution and escalation of privileges.

Affected configurations

Nvd

Node

emersonovation_ocr400_firmwareRange≤3.3.1

AND

emersonovation_ocr400Match-

VendorProductVersionCPE
emersonovation_ocr400_firmware*cpe:2.3:o:emerson:ovation_ocr400_firmware:*:*:*:*:*:*:*:*
emersonovation_ocr400-cpe:2.3:h:emerson:ovation_ocr400:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
emerson	ovation_ocr400_firmware	*	cpe:2.3:o:emerson:ovation_ocr400_firmware::::::::
emerson	ovation_ocr400	-	cpe:2.3:h:emerson:ovation_ocr400:-:::::::*

CNA Affected

[
  {
    "product": "Emerson Ovation OCR400 Controller",
    "vendor": "Emerson",
    "versions": [
      {
        "status": "affected",
        "version": "All versions prior to and including v3.3.1"
      }
    ]
  }
]

References

www.securityfocus.com/bid/108499

ics-cert.us-cert.gov/advisories/ICSA-19-148-01

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.007

Percentile

80.9%

JSON

Related for CVE-2019-10965