CVE-2019-3955
Dameware Remote Mini Control version 12.1.0.34 and prior contains a unauthenticated remote heap overflow due to the server not properly validating RsaPubKeyLen during key negotiation.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 17.9%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
Dameware Remote Mini Control version 12.1.0.34 and prior contains a unauthenticated remote heap overflow due to the server not properly validating RsaPubKeyLen during key negotiation. An unauthenticated remote attacker can cause a heap buffer overflow by specifying a large RsaPubKeyLen, which could cause a denial of service.
- CVSS 3.0
- 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 17.91% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-787
- Affected
- dameware/remote mini control
- Source
- vulnreport@tenable.com
References
- https://www.tenable.com/security/research/tra-2019-26Exploit, Third Party Advisory
- https://www.tenable.com/security/research/tra-2019-26Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.