var-201107-0263
Vulnerability from variot
TCPUploadServer.exe in Progea Movicon 11.2 before Build 1084 does not require authentication for critical functions, which allows remote attackers to obtain sensitive information, delete files, execute arbitrary programs, or cause a denial of service (crash) via a crafted packet to TCP port 10651. Progea Movicon is a new generation of automated monitoring software. A vulnerability exists in TCPUploadServer.exe provided by Progea Movicon that allows remote unauthenticated hosts to execute arbitrary commands on the server. The attacker sends a specially crafted message to the server TCP port 10651, which allows the system to respond to the OS version and driver information. In addition, an attacker sending a specially crafted message can cause the file to be deleted or the server to crash. Progea Movicon is prone to a security-bypass vulnerability. An attacker can exploit this issue to perform unauthorized actions, obtain sensitive information, and cause denial-of-service conditions. Versions prior to Movicon 11.2 Build 1084 are vulnerable
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201107-0263",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "movicon",
"scope": "eq",
"trust": 2.5,
"vendor": "progea",
"version": "11.2"
},
{
"model": "movicon",
"scope": "lt",
"trust": 0.8,
"vendor": "progea srl",
"version": "11.2"
},
{
"model": "movicon",
"scope": "eq",
"trust": 0.8,
"vendor": "progea srl",
"version": "build 1084"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "movicon",
"version": "11.2"
},
{
"model": "movicon build",
"scope": "ne",
"trust": 0.3,
"vendor": "progea",
"version": "11.21084"
}
],
"sources": [
{
"db": "IVD",
"id": "c25a1730-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "9b4ea056-1f9a-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-1214"
},
{
"db": "BID",
"id": "46907"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003492"
},
{
"db": "CNNVD",
"id": "CNNVD-201107-460"
},
{
"db": "NVD",
"id": "CVE-2011-2963"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:progea:movicon",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003492"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Jeremy Brown",
"sources": [
{
"db": "BID",
"id": "46907"
}
],
"trust": 0.3
},
"cve": "CVE-2011-2963",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2011-2963",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "c25a1730-2354-11e6-abef-000c29c66e3d",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "9b4ea056-1f9a-11e6-abef-000c29c66e3d",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2011-2963",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2011-2963",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201107-460",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "IVD",
"id": "c25a1730-2354-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "CRITICAL"
},
{
"author": "IVD",
"id": "9b4ea056-1f9a-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "CRITICAL"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "c25a1730-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "9b4ea056-1f9a-11e6-abef-000c29c66e3d"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003492"
},
{
"db": "CNNVD",
"id": "CNNVD-201107-460"
},
{
"db": "NVD",
"id": "CVE-2011-2963"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "TCPUploadServer.exe in Progea Movicon 11.2 before Build 1084 does not require authentication for critical functions, which allows remote attackers to obtain sensitive information, delete files, execute arbitrary programs, or cause a denial of service (crash) via a crafted packet to TCP port 10651. Progea Movicon is a new generation of automated monitoring software. A vulnerability exists in TCPUploadServer.exe provided by Progea Movicon that allows remote unauthenticated hosts to execute arbitrary commands on the server. The attacker sends a specially crafted message to the server TCP port 10651, which allows the system to respond to the OS version and driver information. In addition, an attacker sending a specially crafted message can cause the file to be deleted or the server to crash. Progea Movicon is prone to a security-bypass vulnerability. \nAn attacker can exploit this issue to perform unauthorized actions, obtain sensitive information, and cause denial-of-service conditions. \nVersions prior to Movicon 11.2 Build 1084 are vulnerable",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-2963"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003492"
},
{
"db": "CNVD",
"id": "CNVD-2011-1214"
},
{
"db": "BID",
"id": "46907"
},
{
"db": "IVD",
"id": "c25a1730-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "9b4ea056-1f9a-11e6-abef-000c29c66e3d"
}
],
"trust": 2.79
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-2963",
"trust": 3.1
},
{
"db": "BID",
"id": "46907",
"trust": 2.5
},
{
"db": "ICS CERT",
"id": "ICSA-11-056-01A",
"trust": 2.4
},
{
"db": "ICS CERT",
"id": "ICSA-11-056-01",
"trust": 1.9
},
{
"db": "EXPLOIT-DB",
"id": "17034",
"trust": 1.6
},
{
"db": "OSVDB",
"id": "72888",
"trust": 1.6
},
{
"db": "CNNVD",
"id": "CNNVD-201107-460",
"trust": 1.0
},
{
"db": "CNVD",
"id": "CNVD-2011-1214",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003492",
"trust": 0.8
},
{
"db": "IVD",
"id": "C25A1730-2354-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "IVD",
"id": "9B4EA056-1F9A-11E6-ABEF-000C29C66E3D",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "c25a1730-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "9b4ea056-1f9a-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-1214"
},
{
"db": "BID",
"id": "46907"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003492"
},
{
"db": "CNNVD",
"id": "CNNVD-201107-460"
},
{
"db": "NVD",
"id": "CVE-2011-2963"
}
]
},
"id": "VAR-201107-0263",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "c25a1730-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "9b4ea056-1f9a-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-1214"
}
],
"trust": 1.65
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 1.0
}
],
"sources": [
{
"db": "IVD",
"id": "c25a1730-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "9b4ea056-1f9a-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-1214"
}
]
},
"last_update_date": "2024-11-23T22:53:33.959000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.progea.com"
},
{
"title": "Progea Movicon \u0027TCPUploadServer.exe\u0027 security bypass vulnerability patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/3376"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-1214"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003492"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-287",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003492"
},
{
"db": "NVD",
"id": "CVE-2011-2963"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "http://www.us-cert.gov/control_systems/pdf/icsa-11-056-01a.pdf"
},
{
"trust": 1.9,
"url": "http://www.us-cert.gov/control_systems/pdf/icsa-11-056-01.pdf"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/46907"
},
{
"trust": 1.6,
"url": "http://www.osvdb.org/72888"
},
{
"trust": 1.6,
"url": "http://www.exploit-db.com/exploits/17034"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-2963"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-2963"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/46907http"
},
{
"trust": 0.3,
"url": "http://www.progea.com/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-1214"
},
{
"db": "BID",
"id": "46907"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003492"
},
{
"db": "CNNVD",
"id": "CNNVD-201107-460"
},
{
"db": "NVD",
"id": "CVE-2011-2963"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "c25a1730-2354-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "9b4ea056-1f9a-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2011-1214"
},
{
"db": "BID",
"id": "46907"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003492"
},
{
"db": "CNNVD",
"id": "CNNVD-201107-460"
},
{
"db": "NVD",
"id": "CVE-2011-2963"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-07-29T00:00:00",
"db": "IVD",
"id": "c25a1730-2354-11e6-abef-000c29c66e3d"
},
{
"date": "2011-03-24T00:00:00",
"db": "IVD",
"id": "9b4ea056-1f9a-11e6-abef-000c29c66e3d"
},
{
"date": "2011-03-24T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-1214"
},
{
"date": "2011-03-15T00:00:00",
"db": "BID",
"id": "46907"
},
{
"date": "2011-12-22T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003492"
},
{
"date": "2011-07-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201107-460"
},
{
"date": "2011-07-29T19:55:04.437000",
"db": "NVD",
"id": "CVE-2011-2963"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-03-24T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-1214"
},
{
"date": "2015-04-13T20:01:00",
"db": "BID",
"id": "46907"
},
{
"date": "2011-12-22T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003492"
},
{
"date": "2011-08-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201107-460"
},
{
"date": "2024-11-21T01:29:22.730000",
"db": "NVD",
"id": "CVE-2011-2963"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201107-460"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Progea Movicon of TCPUploadServer.exe Vulnerability in which important information is obtained",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003492"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "authorization issue",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201107-460"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…