OpenCVE

Horner Automation Cscape lacks proper validation of user-supplied data when parsing project files (e.g., HMI). This could lead to an out-of-bounds write at CScape_EnvisionRV+0x2e374b. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Hornerautomation	Cscape Cscape Envisionrv

Configuration 1 [-]

OR	cpe:2.3:a:hornerautomation:cscape:9.90:sp8::::::
	cpe:2.3:a:hornerautomation:cscape_envisionrv:4.70:::::::*

No data.

References

Link	Providers
https://www.cisa.gov/news-events/ics-advisories/icsa-23-143-04

History

Wed, 20 Nov 2024 16:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119

Wed, 20 Nov 2024 15:45:00 +0000

Type	Values Removed	Values Added
Description	The affected application lacks proper validation of user-supplied data when parsing project files (e.g., HMI). This could lead to an out-of-bounds write at CScape_EnvisionRV+0x2e374b. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.	Horner Automation Cscape lacks proper validation of user-supplied data when parsing project files (e.g., HMI). This could lead to an out-of-bounds write at CScape_EnvisionRV+0x2e374b. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.
Title		Horner Automation Cscape Out-of-bounds Write

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2023-06-06T16:23:54.359Z

Updated: 2024-11-20T15:28:12.909Z

Reserved: 2023-05-09T17:30:31.036Z

Link: CVE-2023-32203

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-06-06T17:15:15.023

Modified: 2024-11-20T16:15:19.177

Link: CVE-2023-32203

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-32203", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2023-05-09T17:30:31.036Z", "datePublished": "2023-06-06T16:23:54.359Z", "dateUpdated": "2024-11-20T15:28:12.909Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Cscape", "vendor": "Horner Automation", "versions": [{"status": "affected", "version": "v9.90 SP8"}]}, {"defaultStatus": "unaffected", "product": "Cscape EnvisionRV", "vendor": "Horner Automation", "versions": [{"status": "affected", "version": "v4.70"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Michael Heinzl reported these vulnerabilities to CISA."}], "datePublic": "2023-05-23T17:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">Horner Automation Cscape lacks proper validation of user-supplied data when parsing project files (e.g., HMI). This could lead to an out-of-bounds write at CScape_EnvisionRV+0x2e374b. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process. </span>\n\n </span>\n\n </span>\n\n </span>\n\n </span>\n\n </span>\n\n</span>\n\n </span>\n\n</span>\n\n</span>\n\n</span>"}], "value": "Horner Automation Cscape lacks proper validation of user-supplied data when parsing project files (e.g., HMI). This could lead to an out-of-bounds write at CScape_EnvisionRV+0x2e374b. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2024-11-20T15:28:12.909Z"}, "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-143-04"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Horner Automation recommends upgrading the following software: </p><ul><li>Cscape: Update to <a target=\"_blank\" rel=\"nofollow\" href=\"https://hornerautomation.com/cscape-software/\">v9.90 SP9</a> </li><li>Cscape Envision RV: Update to <a target=\"_blank\" rel=\"nofollow\" href=\"https://hornerautomation.com/product/cscape-envision-rv/\">v4.80</a> </li></ul>"}], "value": "Horner Automation recommends upgrading the following software: \n\n * Cscape: Update to v9.90 SP9 https://hornerautomation.com/cscape-software/ \u00a0\n * Cscape Envision RV: Update to v4.80 https://hornerautomation.com/product/cscape-envision-rv/"}], "source": {"advisory": "ICSA-23-143-04", "discovery": "EXTERNAL"}, "title": "Horner Automation Cscape Out-of-bounds Write", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:10:24.598Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-143-04", "tags": ["x_transferred"]}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hornerautomation:cscape:9.90:sp8:*:*:*:*:*:*", "matchCriteriaId": "F9866251-8120-422D-9764-E4D7F8A5EE51", "vulnerable": true}, {"criteria": "cpe:2.3:a:hornerautomation:cscape_envisionrv:4.70:*:*:*:*:*:*:*", "matchCriteriaId": "D1CC8502-4810-4BFA-BC19-5F1DEBAFF678", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Horner Automation Cscape lacks proper validation of user-supplied data when parsing project files (e.g., HMI). This could lead to an out-of-bounds write at CScape_EnvisionRV+0x2e374b. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process."}], "id": "CVE-2023-32203", "lastModified": "2024-11-20T16:15:19.177", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}, "published": "2023-06-06T17:15:15.023", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-143-04"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "ics-cert@hq.dhs.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Secondary"}]}