Chuan Wei

A vulnerability has been found in liftoff-sr CIPster up to 632336d414ef708a542377c1aa8d6fdb7c70a760. Affected by this issue is the function CipAppPath::deserialize symbolic of the file source/src/cip/cipepath.cc. Such manipulation leads to out-of-bounds read. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The name of the patch is 886a4d090e1c5b0475f0b1c2fe0606a8f0d6a519. A patch should be applied to remediate this issue.

A vulnerability was identified in open62541 up to 1.5.5. Affected by this issue is the function responseReadNamespacesArray of the file src/client/ua client connect.c of the component Shared Client Library. Such manipulation of the argument Server NamespaceArray leads to null pointer dereference. The attack can be executed remotely. The attack requires a high level of complexity. The exploitation is known to be difficult. The exploit is publicly available and might be used. The project closed the issue report, stating that this is not the official way to report a security vulnerability.

**Name of the Vulnerable Software and Affected Versions** davenardella snap7 versions prior to 1.4.4 **Description** A flaw in the ReadVar Request Handler component allows for deserialization. The issue resides in the `TS7Worker::PerformFunctionRead()` function within the `src/core/s7 server.cpp` file. Exploitation of this issue requires the attacker to have access to the local network. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** liftoff-sr CIPster versions up to e8e9dba09bf56962807d3504b783ccdb6287f3e4 **Description** An out-of-bounds write can occur within the `BufWriter::append()` function of the EtherNet IP Message Handler component. This issue allows for remote exploitation through manipulation of the affected function. **Recommendations** Deploy patch 3a0159ed43125dcd024a1965f0289cb186bae9ff. As a temporary mitigation, restrict access to the `BufWriter::append()` function.