A stack-based buffer overflow flaw in SimTech Systems, Inc. ThinkWise enables remote code inclusion, allowing attackers to execute arbitrary code with the privileges of the affected process. The vulnerability is rooted in improper bounds checking (CWE-121 and CWE-787) and can be exploited by sending a specially crafted input over a network interface. Successful exploitation would compromise confidentiality, integrity, and availability of the impacted system, potentially providing full administrative control.

All installations of SimTech Systems, Inc. ThinkWise from version 7 up to version 23 are affected. The vulnerability spans these releases, and no specific sub‑version details are available. Users running any of these versions should consider the potential for exploitation until a vendor fix is released.

The vulnerability carries a CVSS score of 8.4, signifying high severity. The EPSS probability is below 1%, indicating a very low current likelihood of exploitation, and it is not listed in the CISA KEV catalog, so no known public exploits exist at this time. The attack vector is inferred to be remote, as the flaw allows Remote Code Inclusion via network requests to the affected service. Exploitation would require an attacker to reach the vulnerable entry point, but no local privilege escalation is needed; the impact is confined to the attacker’s remote location.