What is the CVSS score of CVE-2012-5409?

CVE-2012-5409 has a CVSS 2.0 base score of 10.0 (Critical). CVSS vector: AV:N/AC:L/Au:N/C:C/I:C/A:C. EPSS exploitation probability: 35.4%.

Is there a public PoC exploit available for CVE-2012-5409?

Yes, a public proof-of-concept exploit is available for CVE-2012-5409. Prioritise patching immediately. EPSS: 35.4%.

Sipass Integrated CVE-2012-5409

CRITICAL

Buffer Overflow (CWE-119)

2012-11-01 cve@mitre.org

Buffer Overflow Siemens RCE Sipass Integrated

10.0

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/Au:N/C:C/I:C/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Nov 01, 2012 - 10:44 cve.org

CRITICAL 10.0

DescriptionCVE.org

AscoServer.exe in the server in Siemens SiPass integrated MP2.6 and earlier does not properly handle IOCP RPC messages received over an Ethernet network, which allows remote attackers to write data to any memory location and consequently execute arbitrary code via crafted messages, as demonstrated by an arbitrary pointer dereference attack or a buffer overflow attack.

AnalysisAI

AscoServer.exe in the server in Siemens SiPass integrated MP2.6 and earlier does not properly handle IOCP RPC messages received over an Ethernet network, which allows remote attackers to write data. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 35.4%.

Technical ContextAI

This vulnerability is classified as Buffer Overflow (CWE-119), which allows attackers to corrupt memory to execute arbitrary code or crash the application. AscoServer.exe in the server in Siemens SiPass integrated MP2.6 and earlier does not properly handle IOCP RPC messages received over an Ethernet network, which allows remote attackers to write data to any memory location and consequently execute arbitrary code via crafted messages, as demonstrated by an arbitrary pointer dereference attack or a buffer overflow attack. Affected products include: Siemens Sipass Integrated.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use memory-safe languages or bounds-checking. Enable ASLR, DEP/NX, stack canaries. Use safe string functions.