CVE-2011-3330
Buffer overflow in the UnitelWay Windows Device Driver, as used in Schneider Electric Unity Pro 6 and earlier, OPC Factory Server 3.34, Vijeo Citect 7.20 and earlier, Telemecanique Driver Pack 2.6 and earlier, Monitor Pro 7.6 and earlier, and PL7 Pro…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.30%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Buffer overflow in the UnitelWay Windows Device Driver, as used in Schneider Electric Unity Pro 6 and earlier, OPC Factory Server 3.34, Vijeo Citect 7.20 and earlier, Telemecanique Driver Pack 2.6 and earlier, Monitor Pro 7.6 and earlier, and PL7 Pro 4.5 and earlier, allows local users, and possibly remote attackers, to execute arbitrary code via an unspecified system parameter.
- CVSS 2.0
- 7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 1.30% probability · 69th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- schneider-electric/monitor pro · schneider-electric/opc factory server · schneider-electric/pl7 pro · schneider-electric/telemecanique driver pack · schneider-electric/unity pro · schneider-electric/vijeo citect
- Source
- cret@cert.org
References
- http://secunia.com/advisories/46534Vendor Advisory
- http://www.scada.schneider-electric.com/sites/scada/en/login/vijeo-citect-unitelway-windows-device-driver.pageVendor Advisory
- http://www.securityfocus.com/bid/50319
- http://www.securitytracker.com/id?1026234
- http://www.us-cert.gov/control_systems/pdf/ICSA-11-277-01.pdfUS Government Resource
- https://exchange.xforce.ibmcloud.com/vulnerabilities/70882
- http://secunia.com/advisories/46534Vendor Advisory
- http://www.scada.schneider-electric.com/sites/scada/en/login/vijeo-citect-unitelway-windows-device-driver.pageVendor Advisory
- http://www.securityfocus.com/bid/50319
- http://www.securitytracker.com/id?1026234
- http://www.us-cert.gov/control_systems/pdf/ICSA-11-277-01.pdfUS Government Resource
- https://exchange.xforce.ibmcloud.com/vulnerabilities/70882
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.