PT-2022-4634 · Measuresoft · Measuresoft Scadapro Server

Andrea Micalizzi + 3 · Published 2022-08-23 · Updated 2022-09-02 · CVE-2022-2895

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Measuresoft ScadaPro Server (All Versions)

Description The issue is related to the use of unmaintained ActiveX controls in Measuresoft ScadaPro Server, which may lead to two stack-based buffer overflow instances when processing a specific project file. This can allow a remote attacker to execute arbitrary code by exploiting the buffer overflow vulnerability. The vulnerability is associated with reading data beyond the buffer boundaries in memory.

Recommendations For all versions of Measuresoft ScadaPro Server, consider disabling the use of ActiveX controls until a patch or update is available to mitigate the risk of exploitation. Restrict access to project files that could potentially trigger the buffer overflow to minimize the risk of remote code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

BDU:2022-05518

CVE-2022-2895

ZDI-22-1141

ZDI-22-1142

Affected Products

Measuresoft Scadapro Server

References · 6

• https://bdu.fstec.ru/vul/2022-05518 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-2895 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-1141 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-1142 · Security Note
• https://t.me/cvenotify/35565 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-22-235-06 · Note