QID 591137

Date Published: 2022-10-31

QID 591137: Advantech OPC Server Buffer Overflow Vulnerability (ICSA-11-279-01)

Aa buffer overflow vulnerability was discovered that affects multiple Advantech OPC (OLE for Process Control) Server products.

The buffer overflow in the Advantech ADAM OPC Server ActiveX control might allow remote attackers to execute arbitrary code and gain privileges as the currently logged-in user.
An attacker with a low skill level can create a denial of service; however, a more skilled attacker could execute arbitrary code.

Affected Versions:
Advantech ADAM OPC Server Versions prior to V3.01.012
Advantech Modbus RTU OPC Server Versions prior to V3.01.010
Advantech Modbus TCP OPC Server Versions prior to V3.01.010

QID Detection Logic:(Authenticated)
It looks into the windows registry entries HKLM to find the vulnerable versions of the products.

This vulnerability may allow remote code execution and elevated user privileges.

CVSS V3 rated as Critical - 9.8 severity.

CVSS V2 rated as Critical - 10 severity.

Solution

The vendor has released fixes. Please refer to mitigation section of the advisory for updates pertaining the vulnerabilities.

Vendor References

ICSA-11-279-01 - www.cisa.gov/uscert/ics/advisories/ICSA-11-279-01

CVEs related to QID 591137

CVE-2011-1914 |

Software Advisories

Advisory ID	Software	Component	Link
ICSA-11-279-01			www.cisa.gov/uscert/ics/advisories/ICSA-11-279-01

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].