Advantech WebAccess SCADA webvact.ocx NodeName2 Buffer Overflow (CVE-2014-0766)

A stack buffer overflow exists in Advantech's WebAccess SCADA software. This is due to insufficient input validation on the NodeName2 parameter of the webvact.ocx ActiveX control, a part of the WebAccess Client. A remote unauthenticated attacker could exploit this vulnerability by enticing a...

COPA-DATA Patches DNP3 SCADA Vulnerability

A vulnerability exists in a particular brand of SCADA software that if left unpatched, could trigger a denial of service condition and go on to compromise the software’s communication connections, resulting in system instability. The problem is an improper input validation vulnerability and exist...

CVE-2014-2342

Triangle MicroWorks SCADA Data Gateway before 3.00.0635 allows remote attackers to cause a denial of service excessive data processing via a crafted DNP3 packet...

CVE-2014-2343

Triangle MicroWorks SCADA Data Gateway before 3.00.0635 allows physically proximate attackers to cause a denial of service excessive data processing via a crafted DNP request over a serial line...

Code injection

Triangle MicroWorks SCADA Data Gateway before 3.00.0635 allows remote attackers to cause a denial of service excessive data processing via a crafted DNP3 packet...

Design/Logic Flaw

Triangle MicroWorks SCADA Data Gateway before 3.00.0635 allows physically proximate attackers to cause a denial of service excessive data processing via a crafted DNP request over a serial line...

CVE-2014-2343

The CVE concerns Triangle MicroWorks SCADA Data Gateway prior to 3.00.0635, where a crafted DNP3 request on a serial line can cause an input-validation-based DoS due to excessive data processing. A related Nessus entry and ICS-CERT advisory confirm a broader DoS risk in affected releases, with IP...

CVE-2014-2342

Triangle MicroWorks SCADA Data Gateway vulnerable to DoS via crafted DNP3 packets. Affected: versions before 3.00.0635. Root cause: incorrect input validation leading to uncontrolled resource consumption (IP-connected DoS; serial connections also impacted with physical access). Impact: denial of ...

CVE-2014-2343 Triangle MicroWorks SCADA Data Gateway Resource Exhaustion

Triangle MicroWorks SCADA Data Gateway before 3.00.0635 allows physically proximate attackers to cause a denial of service excessive data processing via a crafted DNP request over a serial line...

CVE-2014-2342 Triangle MicroWorks SCADA Data Gateway Resource Exhaustion

Triangle MicroWorks SCADA Data Gateway before 3.00.0635 allows remote attackers to cause a denial of service excessive data processing via a crafted DNP3 packet...

BACnet/IP Protocol Detection (SCADA)

Binary data 6726.prm...

Yokogawa CENTUM CS 3000 SCADA Service Buffer Overflow (CVE-2014-0783)

A remote code execution vulnerability has been reported in Yokogawa CENTUM CS 3000. A remote attacker can exploit this vulnerability by sending specially crafted packets...

ICS-CERT Confirms Public Utility Compromised Recently

Attackers recently compromised a utility in the United States through an Internet-connected system that gave the attackers access to the utility’s internal control system network. The utility, which has not been named, had remote access enabled on some of its Internet-connected hosts and the...

Advantech WebAccess SCADA webvact.ocx UserName Buffer Overflow (CVE-2014-0770)

A stack buffer overflow has been reported in Advantech's WebAccess SCADA software. This is due to insufficient input validation on the UserName parameter of the webvact.ocx ActiveX control, a part of the WebAccess Client. Successful exploitation could lead to code execution in the context of the...

InduSoft Web Studio Thin Client Detection

Binary data 8033.prm...

Ecava Integraxor SCADA Server Vulnerabilities

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on August 12, 2014, and is being released to the NCCIC/ICS-CERT web site. Independent researcher Andrea Micalizzi identified an Improper Privilege Management vulnerability within Ecava’s IntegraXor SCADA Server and...

Yokogawa CENTUM CS 3000 SCADA Remote Code Execution (CVE-2014-0782)

A remote code execution vulnerability has been reported in Yokogawa CENTUM CS 3000. The vulnerability is due to insecure usage of memory creation...

Yokogawa CENTUM CS 3000 SCADA Buffer Overflow (CVE-2014-0784)

A remote code execution vulnerability has been reported in Yokogawa CENTUM CS 3000. The vulnerability is due to a stack based buffer overflow when handling specially crafted packets...

Advantech WebAccess SCADA bwocxrun.ocx Command Execution (CVE-2014-0773)

A command execution vulnerability has been reported in Advantech WebAccess SCADA software. The vulnerability is due to insufficient input validation while parsing the first parameter of the bwocxrun.ocx ActiveX control. A remote, unauthenticated attacker could exploit this vulnerability by entici...

Advantech WebAccess SCADA webvact.ocx NodeName Buffer Overflow (CVE-2014-0764)

A stack buffer overflow has been reported in Advantech's WebAccess SCADA software. This is due to insufficient input validation on the NodeName parameter of the webvact.ocx ActiveX control, a part of the WebAccess Client. A remote, unauthenticated attacker could exploit this vulnerability by...