Siemens SIMATIC UltraVNC HMI WinCC Products

🗓️ 11 May 2021 00:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics

ics🔗 www.cisa.gov👁 92 Views

Siemens SIMATIC UltraVNC HMI WinCC Products, Remote Code Execution Ris

Reporter	Title	Published	Views	Family All 72
BDU FSTEC	The vulnerability of the RRE decoder VNC client component of the remote desktop management software UltraVNC allows a hacker to execute arbitrary code.	16 Apr 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the CoRRE decoder’s VNC client, a software tool for managing remote desktops like UltraVNC, allows a hacker to execute arbitrary code.	16 Apr 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Ultra decoder component of the VNC client software for remote desktop management tools, UltraVNC, allows a intruder to execute arbitrary code.	16 Apr 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the RAW decoder in the VNC client of the software for controlling remote desktops, UltraVNC, allows a hacker to execute arbitrary code.	16 Apr 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Ultra2 decoder in the VNC client software for remote desktop management tools called UltraVNC allows a hacker to execute arbitrary code.	16 Apr 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the VNC client of the remote desktop management software UltraVNC allows a hacker to execute arbitrary code.	16 Apr 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the UltraVNC software, which is part of the monitoring, control, and remote maintenance module for the commercial cold production equipment TelevisGo, allows a intruder to execute arbitrary code.	19 May 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the VNC client software for remote desktop management, UltraVNC, relates to writing beyond the buffer boundaries in memory. This allows a malicious actor to trigger a service failure.	30 Jul 202100:00	–	bdu_fstec
Circl	CVE-2019-8262	7 May 202423:27	–	circl
CNVD	UltraVNC out-of-bounds access vulnerability (CNVD-2019-10286)	11 Mar 201900:00	–	cnvd

Source	Link
cert-portal	www.cert-portal.siemens.com/productcert/csaf/ssa-940818.json
cert-portal	www.cert-portal.siemens.com/productcert/txt/ssa-940818.txt
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-940818.pdf
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-131-11.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-21-131-11
cisa	www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
cisa	www.cisa.gov/resources-tools/resources/ics-recommended-practices
cisa	www.cisa.gov/topics/industrial-control-systems
us-cert	www.us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
cisa	www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

11 May 2021 00:00Current

9.6High risk

Vulners AI Score9.6

CVSS 27.5

CVSS 3.19.8

CVSS 39.8

EPSS0.04843

siemens simatic ultravnc wincc remote code execution information disclosure denial-of-service vulnerabilities improper initialization out-of-bounds read heap-based buffer overflow stack-based buffer overflow memory leakage