by Kastro
Paper/Archive/CVE-2023-2186

CVE-2023-2186

Triangle MicroWorks SCADA Data Gateway — On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send a specially crafted broadcast messag…

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 53.3.533 × 2010.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send a specially crafted broadcast message including format string characters to the SCADA Data Gateway to perform unrestricted memory reads.An unauthenticated user can use this format string vulnerability to repeatedly crash the GTWWebMonitor.exe process to DoS the Web Monitor. Furthermore, an authenticated user can leverage this vulnerability to leak memory from the GTWWebMonitor.exe process. This could be leveraged in an exploit chain to gain code execution.

Affected

ProductAffectedFixed inSource
SCADA Data Gateway5.01.03–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
trellix (CNA)8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

reftrellix.com/en-us/about/newsroom/stories/research/industrial-and-manufacturing-cves.html