FATEK Automation WinProladder

🗓️ 07 Oct 2021 00:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics

ics🔗 www.cisa.gov👁 38 Views

FATEK Automation WinProladder vulnerabilities for arbitrary code execution and unauthorized information disclosur

Reporter	Title	Published	Views	Family All 83
BDU FSTEC	The vulnerability of the FATEK WinProladder software for controlling controllers arises from buffer overflows in the stack, allowing an attacker to execute arbitrary code.	21 Oct 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the FATEK WinProladder controller programming software lies in an unexpected expansion of the symbol, allowing a hacker to execute arbitrary code.	21 Oct 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the FATEK WinProladder controller programming software lies in the fact that the write operation can exceed the buffer boundaries into memory. This allows a malicious actor to execute arbitrary code or cause a service failure.	10 Nov 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the FATEK WinProladder controller programming software lies in the fact that the write operation can exceed the buffer boundaries into memory, allowing an attacker to execute arbitrary code.	12 Nov 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the FATEK WinProladder controller programming software lies in the use of memory after it is freed, allowing a hacker to execute arbitrary code.	16 Nov 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the FATEK WinProladder controller programming software lies in the fact that the write operation can exceed the buffer boundaries into memory, allowing an attacker to execute arbitrary code.	9 Dec 202100:00	–	bdu_fstec
Circl	CVE-2021-38426	18 Oct 202116:32	–	circl
Circl	CVE-2021-38430	18 Oct 202116:32	–	circl
Circl	CVE-2021-38434	18 Oct 202116:31	–	circl
Circl	CVE-2021-38436	18 Oct 202116:32	–	circl

Source	Link
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-280-06.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-21-280-06
fatek	www.fatek.com/en/contact_us.php
us-cert	www.us-cert.cisa.gov/ncas/tips/ST04-014
us-cert	www.us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
us-cert	www.us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B

07 Oct 2021 00:00Current

7.5High risk

Vulners AI Score7.5

CVSS 26.8

CVSS 3.17.8

EPSS0.00555

fatek automation winproladder arbitrary code execution unauthorized information disclosure memory buffer stack-based buffer overflow use after free