[ CVE-2016-4523 · Published 9 Jun 2016 ]

Trihedral VTScada (formerly VTS) Denial-of-Service Vulnerability

Exploited · CISA KEV CVSS 7.5 EPSS 31%No fix listed yet

[ Why it matters ]Priority signals

Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-04-15
EPSS: 31% chance of exploitation in the next 30 days (higher than 98% of CVEs)

[ Description ]Official description

The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via unspecified vectors.

CISA: The WAP interface in Trihedral VTScada (formerly VTS) allows remote attackers to cause a denial-of-service (DoS).

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 6 May 2022): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

www.securityfocus.com/bid/91077Broken LinkThird Party AdvisoryVDB Entry
www.zerodayinitiative.com/advisories/ZDI-16-405Third Party AdvisoryVDB Entry
ics-cert.us-cert.gov/advisories/ICSA-16-159-01Third Party AdvisoryUS Government Resource
www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource