CVE-2012-4709: Buffer Overflow
Invensys Wonderware InTouch HMI 2012 R2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4709?
CVE-2012-4709 has a medium severity rating due to its potential to expose sensitive data and cause denial of service.
How do I fix CVE-2012-4709?
To fix CVE-2012-4709, upgrade to a newer version of Invensys Wonderware InTouch that does not contain this vulnerability.
What impact does CVE-2012-4709 have on my system?
CVE-2012-4709 can allow remote attackers to read sensitive files, send unauthorized HTTP requests, or exhaust system resources.
Is my version of Invensys Wonderware InTouch vulnerable to CVE-2012-4709?
If you are using Invensys Wonderware InTouch 2012 R2 or earlier, your system is vulnerable to CVE-2012-4709.
Can CVE-2012-4709 be exploited remotely?
Yes, CVE-2012-4709 can be exploited remotely without the need for physical access to the affected system.