variot - var-201404-0553

var-201404-0553

Vulnerability from variot

Multiple buffer overflows in the OPC Automation 2.0 Server Object ActiveX control in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 3.5 and earlier, TLXCDSTOFS33 3.5 and earlier, TLXCDLUOFS33 3.5 and earlier, TLXCDLTOFS33 3.5 and earlier, and TLXCDLFOFS33 3.5 and earlier allow remote attackers to cause a denial of service via long arguments to unspecified functions. Schneider Electric provides total solutions for the energy and infrastructure, industrial, data center and network, building and residential markets in more than 100 countries. Zone overflow vulnerability. Allowing a remote attacker to cause a denial of service through the \342\200\230long\342\200\231 parameter. Multiple Schneider Electric Products are prone to a remote buffer-overflow vulnerability because it fails to properly validate user-supplied input. Attackers can exploit this issue to cause a denial-of-service condition. The following products are vulnerable: TLXCDSUOFS33 3.5 and prior TLXCDSTOFS33 3.5 and prior TLXCDLUOFS33 3.5 and prior TLXCDLTOFS33 3.5 and prior TLXCDLFOFS33 3.5 and prior. The application features easy integration, custom interface and more

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201404-0553",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "opc factory server tlxcdstofs",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "schneider electric",
        "version": "3.35"
      },
      {
        "model": "opc factory server tlxcdlfofs",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "schneider electric",
        "version": "3.35"
      },
      {
        "model": "opc factory server tlxcdltofs",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "schneider electric",
        "version": "3.35"
      },
      {
        "model": "opc factory server tlxcdluofs",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "schneider electric",
        "version": "3.35"
      },
      {
        "model": "opc factory server tlxcdsuofs",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "schneider electric",
        "version": "3.35"
      },
      {
        "model": "tlxcdlfofs",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "schneider electric",
        "version": "33 - v3.5"
      },
      {
        "model": "tlxcdltofs",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "schneider electric",
        "version": "33 - v3.5"
      },
      {
        "model": "tlxcdluofs",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "schneider electric",
        "version": "33 - v3.5"
      },
      {
        "model": "tlxcdstofs",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "schneider electric",
        "version": "33 - v3.5"
      },
      {
        "model": "tlxcdsuofs",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "schneider electric",
        "version": "33 - v3.5"
      },
      {
        "model": "electric tlxcdsuofs33",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider",
        "version": "3.5"
      },
      {
        "model": "electric tlxcdstofs33",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider",
        "version": "3.5"
      },
      {
        "model": "electric tlxcdluofs33",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider",
        "version": "3.5"
      },
      {
        "model": "electric tlxcdlfofs33",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider",
        "version": "3.5"
      },
      {
        "model": "opc factory server tlxcdluofs",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider electric",
        "version": "3.35"
      },
      {
        "model": "opc factory server tlxcdstofs",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider electric",
        "version": "3.35"
      },
      {
        "model": "opc factory server tlxcdlfofs",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider electric",
        "version": "3.35"
      },
      {
        "model": "opc factory server tlxcdsuofs",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider electric",
        "version": "3.35"
      },
      {
        "model": "opc factory server tlxcdltofs",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider electric",
        "version": "3.35"
      },
      {
        "model": "opc factory server tlxcdsuofs33",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "schneider electric",
        "version": "3.5"
      },
      {
        "model": "opc factory server tlxcdstofs33",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "schneider electric",
        "version": "3.5"
      },
      {
        "model": "opc factory server tlxcdluofs33",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "schneider electric",
        "version": "3.5"
      },
      {
        "model": "opc factory server tlxcdltofs33",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "schneider electric",
        "version": "3.5"
      },
      {
        "model": "opc factory server tlxcdlfofs33",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "schneider electric",
        "version": "3.5"
      },
      {
        "model": "opc factory server sp1",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "schneider electric",
        "version": "3.5"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "opc factory server tlxcdlfofs",
        "version": "*"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "opc factory server tlxcdltofs",
        "version": "*"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "opc factory server tlxcdluofs",
        "version": "*"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "opc factory server tlxcdstofs",
        "version": "*"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "opc factory server tlxcdsuofs",
        "version": "*"
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "1ab16a62-2352-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-02181"
      },
      {
        "db": "BID",
        "id": "66643"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001905"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201404-058"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0789"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/h:schneider_electric:opc_factory_server_tlxcdlfofs",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/h:schneider_electric:opc_factory_server_tlxcdltofs",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/h:schneider_electric:opc_factory_server_tlxcdluofs",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/h:schneider_electric:opc_factory_server_tlxcdstofs",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/h:schneider_electric:opc_factory_server_tlxcdsuofs",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001905"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Wei Gao",
    "sources": [
      {
        "db": "BID",
        "id": "66643"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2014-0789",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.8,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "CVE-2014-0789",
            "impactScore": 6.9,
            "integrityImpact": "NONE",
            "severity": "HIGH",
            "trust": 1.8,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.8,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "CNVD-2014-02181",
            "impactScore": 6.9,
            "integrityImpact": "NONE",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "IVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.8,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "1ab16a62-2352-11e6-abef-000c29c66e3d",
            "impactScore": 6.9,
            "integrityImpact": "NONE",
            "severity": "HIGH",
            "trust": 0.2,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
            "version": "2.9 [IVD]"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.8,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "VHN-68282",
            "impactScore": 6.9,
            "integrityImpact": "NONE",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2014-0789",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2014-0789",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2014-02181",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201404-058",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "IVD",
            "id": "1ab16a62-2352-11e6-abef-000c29c66e3d",
            "trust": 0.2,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-68282",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "1ab16a62-2352-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-02181"
      },
      {
        "db": "VULHUB",
        "id": "VHN-68282"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001905"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201404-058"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0789"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Multiple buffer overflows in the OPC Automation 2.0 Server Object ActiveX control in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 3.5 and earlier, TLXCDSTOFS33 3.5 and earlier, TLXCDLUOFS33 3.5 and earlier, TLXCDLTOFS33 3.5 and earlier, and TLXCDLFOFS33 3.5 and earlier allow remote attackers to cause a denial of service via long arguments to unspecified functions. Schneider Electric provides total solutions for the energy and infrastructure, industrial, data center and network, building and residential markets in more than 100 countries. Zone overflow vulnerability. Allowing a remote attacker to cause a denial of service through the \\342\\200\\230long\\342\\200\\231 parameter. Multiple Schneider Electric Products are prone to a remote buffer-overflow vulnerability because it fails to properly validate user-supplied input. \nAttackers can exploit this issue to cause a denial-of-service condition. \nThe following products are vulnerable:\nTLXCDSUOFS33 3.5 and prior\nTLXCDSTOFS33 3.5 and prior\nTLXCDLUOFS33 3.5 and prior\nTLXCDLTOFS33 3.5 and prior\nTLXCDLFOFS33 3.5 and prior. The application features easy integration, custom interface and more",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-0789"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001905"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-02181"
      },
      {
        "db": "BID",
        "id": "66643"
      },
      {
        "db": "IVD",
        "id": "1ab16a62-2352-11e6-abef-000c29c66e3d"
      },
      {
        "db": "VULHUB",
        "id": "VHN-68282"
      }
    ],
    "trust": 2.7
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2014-0789",
        "trust": 3.6
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-14-093-01",
        "trust": 2.8
      },
      {
        "db": "BID",
        "id": "66643",
        "trust": 1.0
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201404-058",
        "trust": 0.9
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-02181",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001905",
        "trust": 0.8
      },
      {
        "db": "IVD",
        "id": "1AB16A62-2352-11E6-ABEF-000C29C66E3D",
        "trust": 0.2
      },
      {
        "db": "VULHUB",
        "id": "VHN-68282",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "1ab16a62-2352-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-02181"
      },
      {
        "db": "VULHUB",
        "id": "VHN-68282"
      },
      {
        "db": "BID",
        "id": "66643"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001905"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201404-058"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0789"
      }
    ]
  },
  "id": "VAR-201404-0553",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "IVD",
        "id": "1ab16a62-2352-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-02181"
      },
      {
        "db": "VULHUB",
        "id": "VHN-68282"
      }
    ],
    "trust": 1.9
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "1ab16a62-2352-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-02181"
      }
    ]
  },
  "last_update_date": "2024-11-23T22:39:02.587000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Vulnerability Disclosure - OPC Factory Server Buffer Overflow (SEVD 2014-084-01)",
        "trust": 0.8,
        "url": "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-084-01"
      },
      {
        "title": "Cybersecurity News",
        "trust": 0.8,
        "url": "http://www.schneider-electric.com/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/Content/News/data/en/local/cybersecurity/general_information/2014/03/20140325_vulnerability_disclosure_opc_factory_server.xml"
      },
      {
        "title": "Patch for multiple Schneider Electric product heap buffer overflow vulnerabilities",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchInfo/show/44691"
      },
      {
        "title": "OFS_CD2906_V350_SP1",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=49093"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-02181"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001905"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201404-058"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-119",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-68282"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001905"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0789"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.8,
        "url": "http://ics-cert.us-cert.gov/advisories/icsa-14-093-01"
      },
      {
        "trust": 1.7,
        "url": "http://www.schneider-electric.com/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/content/news/data/en/local/cybersecurity/general_information/2014/03/20140325_vulnerability_disclosure_opc_factory_server.xml"
      },
      {
        "trust": 1.4,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-0789"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0789"
      },
      {
        "trust": 0.6,
        "url": "http://www.securityfocus.com/bid/66643"
      },
      {
        "trust": 0.3,
        "url": "http://chemical-facility-security-news.blogspot.com/2014/04/yet-another-schneider-advisory-from-ics.html"
      },
      {
        "trust": 0.3,
        "url": "http://www.schneider-electric.com/site/home/index.cfm/ww/?selectcountry=true"
      },
      {
        "trust": 0.3,
        "url": "http://www2.schneider-electric.com/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/content/news/data/en/local/cybersecurity/general_information/2014/03/20140325_vulnerabil"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-02181"
      },
      {
        "db": "VULHUB",
        "id": "VHN-68282"
      },
      {
        "db": "BID",
        "id": "66643"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001905"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201404-058"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0789"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "IVD",
        "id": "1ab16a62-2352-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-02181"
      },
      {
        "db": "VULHUB",
        "id": "VHN-68282"
      },
      {
        "db": "BID",
        "id": "66643"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001905"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201404-058"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0789"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-04-10T00:00:00",
        "db": "IVD",
        "id": "1ab16a62-2352-11e6-abef-000c29c66e3d"
      },
      {
        "date": "2014-04-09T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2014-02181"
      },
      {
        "date": "2014-04-04T00:00:00",
        "db": "VULHUB",
        "id": "VHN-68282"
      },
      {
        "date": "2014-03-25T00:00:00",
        "db": "BID",
        "id": "66643"
      },
      {
        "date": "2014-04-07T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-001905"
      },
      {
        "date": "2014-04-09T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201404-058"
      },
      {
        "date": "2014-04-04T15:09:45.917000",
        "db": "NVD",
        "id": "CVE-2014-0789"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-04-10T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2014-02181"
      },
      {
        "date": "2014-04-04T00:00:00",
        "db": "VULHUB",
        "id": "VHN-68282"
      },
      {
        "date": "2014-03-25T00:00:00",
        "db": "BID",
        "id": "66643"
      },
      {
        "date": "2014-04-07T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-001905"
      },
      {
        "date": "2014-04-09T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201404-058"
      },
      {
        "date": "2024-11-21T02:02:48.357000",
        "db": "NVD",
        "id": "CVE-2014-0789"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201404-058"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "plural  Schneider Electric OPC Factory Server Product buffer overflow vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001905"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Buffer overflow",
    "sources": [
      {
        "db": "IVD",
        "id": "1ab16a62-2352-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201404-058"
      }
    ],
    "trust": 0.8
  }
}

CVE-2014-0789 (GCVE-0-2014-0789)

Vulnerability from cvelistv5

Published

2014-04-04 15:00

Modified

2025-09-25 17:45

Severity ?

CWE

CWE-122

Summary

References

▼	URL	Tags
	https://www.cisa.gov/news-events/ics-advisories/icsa-14-093-01
	http://www.schneider-electric.com/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/Content/News/data/en/local/cybersecurity/general_information/2014/03/20140325_vulnerability_disclosure_opc_factory_server.xml	x_refsource_CONFIRM
	http://www2.schneider-electric.com/sites/corporate/en/support/cybersecurity/cybersecurity.page

Impacted products

	Vendor	Product	Version
	Schneider Electric	OPC Factory Server (OFS)	Version: 0 < Version: 0 < Version: 0 < Version: 0 < Version: 0 <

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T09:27:19.528Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-093-01"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.schneider-electric.com/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/Content/News/data/en/local/cybersecurity/general_information/2014/03/20140325_vulnerability_disclosure_opc_factory_server.xml"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OPC Factory Server (OFS)",
          "vendor": "Schneider Electric",
          "versions": [
            {
              "lessThanOrEqual": "TLXCDSUOFS33 \u2013 V3.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "TLXCDSTOFS33 \u2013 V3.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "TLXCDLUOFS33 \u2013 V3.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "TLXCDLTOFS33 \u2013 V3.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "TLXCDLFOFS33 \u2013 V3.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wei Gao, formerly of IXIA"
        }
      ],
      "datePublic": "2014-04-03T06:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMultiple buffer overflows in the OPC Automation 2.0 Server Object ActiveX control in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 3.5 and earlier, TLXCDSTOFS33 3.5 and earlier, TLXCDLUOFS33 3.5 and earlier, TLXCDLTOFS33 3.5 and earlier, and TLXCDLFOFS33 3.5 and earlier allow remote attackers to cause a denial of service via long arguments to unspecified functions.\u003c/p\u003e"
            }
          ],
          "value": "Multiple buffer overflows in the OPC Automation 2.0 Server Object ActiveX control in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 3.5 and earlier, TLXCDSTOFS33 3.5 and earlier, TLXCDLUOFS33 3.5 and earlier, TLXCDLTOFS33 3.5 and earlier, and TLXCDLFOFS33 3.5 and earlier allow remote attackers to cause a denial of service via long arguments to unspecified functions."
        }
      ],
      "metrics": [
        {
          "cvssV2_0": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-25T17:45:27.086Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-093-01"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.schneider-electric.com/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/Content/News/data/en/local/cybersecurity/general_information/2014/03/20140325_vulnerability_disclosure_opc_factory_server.xml"
        },
        {
          "url": "http://www2.schneider-electric.com/sites/corporate/en/support/cybersecurity/cybersecurity.page"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSchneider Electric has developed a patch to resolve this issue. In order to patch the installation in the field, install OFS V3.5SP1, available on Schneider Electric\u2019s web site at the following URL:\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://www.schneider-electric.com/download/WW/EN/results/0/0/8336568-OPC-Factory-Server/0/?showAsIframe=true\"\u003ehttp://www.schneider-electric.com/download/WW/EN/results/0/0/8336568-OPC-Factory-Server/0/?showAsIfr...\u003c/a\u003e\u003c/p\u003e\u003cp\u003eOFS V3.5SP1 includes a patched version of the OLE2T macro from Microsoft to resolve the issue.\u003c/p\u003e\u003cp\u003eFor more information regarding this issue, please see the security announcements affecting the OPC Factory Server on Schneider Electric\u2019s web site at the following URL:\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://www2.schneider-electric.com/sites/corporate/en/support/cybersecurity/cybersecurity.page\"\u003ehttp://www2.schneider-electric.com/sites/corporate/en/support/cybersecurity/cybersecurity.page\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Schneider Electric has developed a patch to resolve this issue. In order to patch the installation in the field, install OFS V3.5SP1, available on Schneider Electric\u2019s web site at the following URL:\u00a0 http://www2.schneider-electric.com/sites/corporate/en/support/cybersecurity/cybersecurity.page"
        }
      ],
      "source": {
        "advisory": "ICSA-14-093-01",
        "discovery": "EXTERNAL"
      },
      "title": "Schneider Electric OPC Factory Server Buffer Overflow",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2014-0789",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple buffer overflows in the OPC Automation 2.0 Server Object ActiveX control in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 3.5 and earlier, TLXCDSTOFS33 3.5 and earlier, TLXCDLUOFS33 3.5 and earlier, TLXCDLTOFS33 3.5 and earlier, and TLXCDLFOFS33 3.5 and earlier allow remote attackers to cause a denial of service via long arguments to unspecified functions."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://ics-cert.us-cert.gov/advisories/ICSA-14-093-01",
              "refsource": "MISC",
              "url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-093-01"
            },
            {
              "name": "http://www.schneider-electric.com/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/Content/News/data/en/local/cybersecurity/general_information/2014/03/20140325_vulnerability_disclosure_opc_factory_server.xml",
              "refsource": "CONFIRM",
              "url": "http://www.schneider-electric.com/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/Content/News/data/en/local/cybersecurity/general_information/2014/03/20140325_vulnerability_disclosure_opc_factory_server.xml"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2014-0789",
    "datePublished": "2014-04-04T15:00:00",
    "dateReserved": "2014-01-02T00:00:00",
    "dateUpdated": "2025-09-25T17:45:27.086Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted