CVE-2008-2005
The SuiteLink Service (aka slssvc.exe) in WonderWare SuiteLink before 2.0 Patch 01, as used in WonderWare InTouch 8.0, allows remote attackers to cause a denial of service (NULL pointer dereference and service shutdown) and possibly execute arbitrary…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 16.3%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
The SuiteLink Service (aka slssvc.exe) in WonderWare SuiteLink before 2.0 Patch 01, as used in WonderWare InTouch 8.0, allows remote attackers to cause a denial of service (NULL pointer dereference and service shutdown) and possibly execute arbitrary code via a large length value in a Registration packet to TCP port 5413, which causes a memory allocation failure.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
- EPSS
- 16.32% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-399
- Affected
- wonderware/intouch · wonderware/suitelink
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/30063
- http://www.coresecurity.com/?action=item&id=2187Exploit
- http://www.kb.cert.org/vuls/id/596268US Government Resource
- http://www.securityfocus.com/archive/1/491623/100/0/threaded
- http://www.securityfocus.com/bid/28974
- http://www.securitytracker.com/id?1019966
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42221
- https://www.exploit-db.com/exploits/6474
- http://secunia.com/advisories/30063
- http://www.coresecurity.com/?action=item&id=2187Exploit
- http://www.kb.cert.org/vuls/id/596268US Government Resource
- http://www.securityfocus.com/archive/1/491623/100/0/threaded
- http://www.securityfocus.com/bid/28974
- http://www.securitytracker.com/id?1019966
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42221
- https://www.exploit-db.com/exploits/6474
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.