PT-2020-12041 · Visual Components · Visual Components

Sharon Brizinov · Published 2020-11-06 · Updated 2022-05-13 · CVE-2020-10292

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Visual Components (affected versions not specified)

Description The Visual Components software, a robotic simulator, has a vulnerability in its network license server. The server, which listens on UDP port 5093, does not require authentication or authorization to communicate. This allows an attacker to send a specially crafted package that can cause an arbitrary pointer from the stack to be dereferenced, leading to an uncaught exception that terminates the service. The protocol used by the RMS Sentinel license manager service is vulnerable to a denial-of-service (DoS) attack through an arbitrary pointer dereference. This vulnerability can be combined with other issues, such as information disclosure leaks or stack-overflows, to potentially execute code. The software's ability to interface with industrial machinery and automate processes could lead to higher repercussions in the event of a DoS attack, depending on the Industrial Control System (ICS) infrastructure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-248

CWE-119

Related Identifiers

CVE-2020-10292

Affected Products

Visual Components

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-10292 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10292 · Vendor Advisory
• https://visualcomponents.com/products/visual-components · Vendor Advisory
• https://t.me/cvenotify/20839 · Telegram Post
• https://t.me/cvenotify/30213 · Telegram Post
• https://t.me/cibsecurity/15966 · Telegram Post
• https://t.me/cvenotify/5236 · Telegram Post