CVE-2011-4055
Buffer overflow in the WebClient ActiveX control in Siemens Tecnomatix FactoryLink 6.6.1 (aka 6.6 SP1), 7.5.217 (aka 7.5 SP2), and 8.0.2.54 allows remote attackers to execute arbitrary code via a long string in a parameter associated with the location…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.56%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Buffer overflow in the WebClient ActiveX control in Siemens Tecnomatix FactoryLink 6.6.1 (aka 6.6 SP1), 7.5.217 (aka 7.5 SP2), and 8.0.2.54 allows remote attackers to execute arbitrary code via a long string in a parameter associated with the location URL.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 4.56% probability · 91th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- siemens/tecnomatix factorylink
- Source
- cret@cert.org
References
- http://www.securityfocus.com/bid/51266
- http://www.us-cert.gov/control_systems/pdf/ICSA-11-343-01.pdfUS Government Resource
- http://www.usdata.com/sea/factorylink/en/p_nav5.aspPatch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/72117
- http://www.securityfocus.com/bid/51266
- http://www.us-cert.gov/control_systems/pdf/ICSA-11-343-01.pdfUS Government Resource
- http://www.usdata.com/sea/factorylink/en/p_nav5.aspPatch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/72117
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.