CVE-2021-44462: Horner Automation Cscape EnvisionRV Improper Input Validation
First published: Tue Dec 21 2021(Updated: )
This vulnerability can be exploited by parsing maliciously crafted project files with Horner Automation Cscape EnvisionRV v4.50.3.1 and prior. The issues result from the lack of proper validation of user-supplied data, which can result in reads and writes past the end of allocated data structures. User interaction is required to exploit this vulnerability as an attacker must trick a valid user to open a malicious HMI project file.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Hornerautomation Cscape Envisionrv | <=4.50.3.1 | |
| Horner Automation Cscape EnvisionRV v4.50.3.1 and prior |
Remedy
Horner Automation recommends affected users update to the latest version of Cscape Envision RV (Version 4.60). Users with questions regarding their specific software installations should contact their local Horner Automation service support team at either: techsppt@heapg.com (+1-317-916-4274), or technical.support@horner-apg.com (+353-(0)21-4321266 ext. 202) outside of the Americas
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID is CVE-2021-44462.
How can this vulnerability be exploited?
This vulnerability can be exploited by parsing maliciously crafted project files with Horner Automation Cscape EnvisionRV v4.50.3.1 and prior.
What is the severity of CVE-2021-44462?
The severity of CVE-2021-44462 is high with a CVSS score of 7.1.
What software versions are affected by CVE-2021-44462?
Horner Automation Cscape EnvisionRV version 4.50.3.1 and prior versions are affected by CVE-2021-44462.
How can I fix CVE-2021-44462?
To fix CVE-2021-44462, it is recommended to update Horner Automation Cscape EnvisionRV to a version beyond 4.50.3.1.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/title
- agent/author
- agent/remedy
- agent/description
- agent/first-publish-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/event
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup
- vendor/hornerautomation
- canonical/hornerautomation cscape envisionrv
- version/hornerautomation cscape envisionrv/4.50.3.1
- vendor/horner automation
- canonical/horner automation cscape envisionrv v4.50.3.1 and prior