CVE-2023-32203: Horner Automation Cscape Out-of-bounds Write

Reference Links

• https://www.cisa.gov/news-events/ics-advisories/icsa-23-143-04 (Advisory)

Parent vulnerabilities

(Appears in the following advisories)

• ICSA-23-143-04

Frequently Asked Questions

• What is CVE-2023-32203?

  CVE-2023-32203 is a vulnerability in the Horner Automation Cscape and Cscape Envisionrv applications that allows an attacker to execute arbitrary code by exploiting improper validation of user-supplied data when parsing project files.

• How severe is the CVE-2023-32203 vulnerability?

  The severity of CVE-2023-32203 is high, with a CVSS score of 7.8.

• What software is affected by CVE-2023-32203?

  Horner Automation Cscape version 9.90-sp8 and Cscape Envisionrv version 4.70 are affected by CVE-2023-32203.

• How can an attacker exploit CVE-2023-32203?

  An attacker can exploit CVE-2023-32203 by leveraging the out-of-bounds write vulnerability at CScape_EnvisionRV+0x2e374b to execute arbitrary code in the context of the affected application.

• Is there a fix available for CVE-2023-32203?

  As of now, there is no known fix or patch available for CVE-2023-32203. It is recommended to follow the guidance provided by the vendor or the official advisory.