CVE-2019-8280: Critical severity ultravnc vulnerability
Published Mar 1, 2019
·Updated
UltraVNC revision 1203 has out-of-bounds access vulnerability in VNC client inside RAW decoder, which can potentially result code execution. This attack appear to be exploitable via network connectivity. This vulnerability has been fixed in revision 1204.
Affected Software
13 affected componentsFixes available
Uvnc Ultravnc<1.2.2.3
Siemens SIMATIC HMI Comfort Outdoor Panels 7’ and 15’ (incl. SIPLUS variants) Update 4<16
16
Siemens SIMATIC HMI Comfort Panels 4’to 22’ (incl. SIPLUS variants) Update 4<16
16
Siemens SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900, and KTP900F Update 4<16
16
Siemens SIMATIC WinCC Runtime Advanced Update 4<16
16
Siemens SINAMICS GH150
Siemens SINAMICS GL150 (with option X30)
Siemens SINAMICS GM150 (with option X30)
Siemens SINAMICS SH150
Siemens SINAMICS SL150
Siemens SINAMICS SM120
Siemens SINAMICS SM150
Siemens SINAMICS SM150i
Event History
Mar 8, 2019
CVE Published
11:29 PM
Data Sourced
via NVD·11:29 PM
DescriptionSeverityWeaknessAffected Software
Mar 9, 2019
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
1
What is the severity of CVE-2019-8280?
CVE-2019-8280 has a critical severity level due to potential code execution risks via network connectivity.
2
How do I fix CVE-2019-8280?
To fix CVE-2019-8280, upgrade to UltraVNC revision 1204 or later.
3
What systems are affected by CVE-2019-8280?
CVE-2019-8280 affects UltraVNC versions up to 1.2.2.3 and various Siemens SINAMICS and SIMATIC products.
4
Can CVE-2019-8280 be exploited remotely?
Yes, CVE-2019-8280 can be exploited remotely through network access.
5
Is there a patch available for CVE-2019-8280?
Yes, a patch is available by upgrading to UltraVNC revision 1204, which resolves CVE-2019-8280.