PT-2022-2282 · Unknown · Interactive Graphical Scada System Data Server

Published 2022-02-08 · Updated 2022-02-17 · CVE-2022-24310

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Interactive Graphical SCADA System Data Server versions V15.0.0.22020 and prior

Description The issue is caused by an integer overflow or wraparound, leading to a heap-based buffer overflow. This could allow a remote attacker to cause a denial of service or potentially execute arbitrary code by sending specially crafted messages.

Recommendations For versions V15.0.0.22020 and prior, update to a version that fixes the integer overflow issue to prevent potential remote code execution and denial of service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BDU:2022-02453

CVE-2022-24310

Affected Products

Interactive Graphical Scada System Data Server

References · 4

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24310 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02453 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-24310 · Security Note