What is the CVSS score of CVE-2012-4357?

CVE-2012-4357 has a CVSS 2.0 base score of 9.3 (Critical). CVSS vector: AV:N/AC:M/Au:N/C:C/I:C/A:C. EPSS exploitation probability: 21.5%.

Is there a public PoC exploit available for CVE-2012-4357?

Yes, a public proof-of-concept exploit is available for CVE-2012-4357. Prioritise patching immediately. EPSS: 21.5%.

Winlog Pro CVE-2012-4357

CRITICAL

Improper Input Validation (CWE-20)

2012-08-19 cve@mitre.org

RCE Winlog Pro Winlog Lite

9.3

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:N/AC:M/Au:N/C:C/I:C/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:C/I:C/A:C

Attack Vector

Network

Attack Complexity

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Aug 19, 2012 - 20:55 cve.org

CRITICAL 9.3

DescriptionCVE.org

Array index error in Sielco Sistemi Winlog Pro SCADA before 2.07.17 and Winlog Lite SCADA before 2.07.17 might allow remote attackers to execute arbitrary code by referencing, within a port-46824 TCP packet, an invalid file-pointer index that leads to execution of an EnterCriticalSection code block.

AnalysisAI

Array index error in Sielco Sistemi Winlog Pro SCADA before 2.07.17 and Winlog Lite SCADA before 2.07.17 might allow remote attackers to execute arbitrary code by referencing, within a port-46824 TCP. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 21.5%.

Technical ContextAI

This vulnerability is classified under CWE-20. Array index error in Sielco Sistemi Winlog Pro SCADA before 2.07.17 and Winlog Lite SCADA before 2.07.17 might allow remote attackers to execute arbitrary code by referencing, within a port-46824 TCP packet, an invalid file-pointer index that leads to execution of an EnterCriticalSection code block. Affected products include: Sielcosistemi Winlog Pro, Sielcosistemi Winlog Lite. Version information: before 2.07.17.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.