CVE-2015-2868

2017-01-0621:00:00

certcc

www.cve.org

0.018 Low

EPSS

Percentile

88.3%

JSON

An exploitable remote code execution vulnerability exists in the Trane ComfortLink II firmware version 2.0.2 in DSS service. An attacker who can connect to the DSS service on the Trane ComfortLink II device can send an overly long REG request that can overflow a fixed size stack buffer, resulting in arbitrary code execution.

CNA Affected

[
  {
    "product": "ComfortLink II SCC firmware",
    "vendor": "Trane",
    "versions": [
      {
        "status": "affected",
        "version": "2.0.2"
      }
    ]
  }
]