CVE-2014-9190
critical
CVSS v3
—
CVSS v2
10.0
VIR risk
10.0
Description
Stack-based buffer overflow in Schneider Electric Wonderware InTouch Access Anywhere Server 10.6 and 11.0 allows remote attackers to execute arbitrary code via a request for a filename that does not exist.
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| schneider-electric | wonderware_intouch_access_anywhere_server | 10.6 | |
| schneider-electric | wonderware_intouch_access_anywhere_server | 11.0 | |
References
- https://wdnresource.wonderware.com/support/docs/_SecurityBulletins/Security_Bulletin_LFSEC00000104.pdf
- https://www.cisa.gov/news-events/ics-advisories/icsa-15-008-02
- https://ics-cert.us-cert.gov/advisories/ICSA-15-008-02
- https://wdnresource.wonderware.com/support/docs/_SecurityBulletins/Security_Bulletin_LFSEC00000104.pdf
CWEs
CWE-121 CWE-119
Verify integrity in audit chain (admin only). AS-IS.