CVE-2023-32539 - OpenCVE

The affected application lacks proper validation of user-supplied data when parsing project files (e.g., HMI). This could lead to an out-of-bounds write at CScape_EnvisionRV+0x2e3c04. An attacker could leverage this vulnerability to potentially execute arbitrary code in the context of the current process.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Hornerautomation	Cscape Cscape Envisionrv

Configuration 1 [-]

OR	cpe:2.3:a:hornerautomation:cscape:9.90:sp8::::::
	cpe:2.3:a:hornerautomation:cscape_envisionrv:4.70:::::::*

No data.

References

Link	Providers
https://www.cisa.gov/news-events/ics-advisories/icsa-23-143-04

History

No history.

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2023-06-06T15:11:19.755Z

Updated: 2024-08-02T15:18:37.603Z

Reserved: 2023-05-09T17:30:31.046Z

Link: CVE-2023-32539

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2023-06-06T16:15:10.297

Modified: 2023-06-12T16:35:32.033

Link: CVE-2023-32539

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-32539", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2023-05-09T17:30:31.046Z", "datePublished": "2023-06-06T15:11:19.755Z", "dateUpdated": "2024-08-02T15:18:37.603Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Cscape", "vendor": "Horner Automation", "versions": [{"status": "affected", "version": "v9.90 SP8"}]}, {"defaultStatus": "unaffected", "product": "Cscape EnvisionRV", "vendor": "Horner Automation", "versions": [{"status": "affected", "version": "v4.70"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Michael Heinzl reported these vulnerabilities to CISA. "}], "datePublic": "2023-05-23T17:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">The affected application lacks proper validation of user-supplied data when parsing project files (e.g., HMI). This could lead to an out-of-bounds write at CScape_EnvisionRV+0x2e3c04. An attacker could leverage this vulnerability to potentially execute arbitrary code in the context of the current process.</span>\n\n </span>\n\n </span>\n\n </span>\n\n </span>\n\n </span>\n\n </span>\n\n</span>\n\n </span>\n\n</span>\n\n</span>\n\n</span>\n\n"}], "value": "\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nThe affected application lacks proper validation of user-supplied data when parsing project files (e.g., HMI). This could lead to an out-of-bounds write at CScape_EnvisionRV+0x2e3c04. An attacker could leverage this vulnerability to potentially execute arbitrary code in the context of the current process.\n\n \n\n \n\n \n\n \n\n \n\n \n\n\n\n \n\n\n\n\n\n\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-119", "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2023-06-06T15:11:19.755Z"}, "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-143-04"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n\n\n<p>Horner Automation recommends upgrading the following software: </p><ul><li>Cscape: Update to <a target=\"_blank\" rel=\"nofollow\" href=\"https://hornerautomation.com/cscape-software/\">v9.90 SP9</a> </li><li>Cscape Envision RV: Update to <a target=\"_blank\" rel=\"nofollow\" href=\"https://hornerautomation.com/product/cscape-envision-rv/\">v4.80</a> </li></ul>"}], "value": "\n\n\nHorner Automation recommends upgrading the following software: \n\n * Cscape: Update to v9.90 SP9 https://hornerautomation.com/cscape-software/ \u00a0\n * Cscape Envision RV: Update to v4.80 https://hornerautomation.com/product/cscape-envision-rv/ \u00a0\n\n\n"}], "source": {"advisory": "ICSA-23-143-04", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:18:37.603Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-143-04", "tags": ["x_transferred"]}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hornerautomation:cscape:9.90:sp8:*:*:*:*:*:*", "matchCriteriaId": "F9866251-8120-422D-9764-E4D7F8A5EE51", "vulnerable": true}, {"criteria": "cpe:2.3:a:hornerautomation:cscape_envisionrv:4.70:*:*:*:*:*:*:*", "matchCriteriaId": "D1CC8502-4810-4BFA-BC19-5F1DEBAFF678", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nThe affected application lacks proper validation of user-supplied data when parsing project files (e.g., HMI). This could lead to an out-of-bounds write at CScape_EnvisionRV+0x2e3c04. An attacker could leverage this vulnerability to potentially execute arbitrary code in the context of the current process.\n\n \n\n \n\n \n\n \n\n \n\n \n\n\n\n \n\n\n\n\n\n\n\n"}], "id": "CVE-2023-32539", "lastModified": "2023-06-12T16:35:32.033", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}, "published": "2023-06-06T16:15:10.297", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-143-04"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-119"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}