Skip to main content

Wonderware Information Server CVE-2013-0685

CRITICAL
Permissions, Privileges, and Access Controls (CWE-264)
2013-05-09 ics-cert@hq.dhs.gov
Privilege Escalation Denial Of Service RCE Wonderware Information Server
9.3
CVSS 2.0 · NVD
Share

Severity by source

NVD PRIMARY
9.3 CRITICAL
AV:N/AC:M/Au:N/C:C/I:C/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:C/I:C/A:C
Attack Vector
Network
Attack Complexity
M
Confidentiality
C
Integrity
C
Availability
C

Lifecycle Timeline

1
CVE Published
May 09, 2013 - 12:31 cve.org
CRITICAL 9.3

DescriptionCVE.org

Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal does not restrict unspecified size and amount values, which allows remote attackers to execute arbitrary code or cause a denial of service (resource consumption) via unknown vectors.

AnalysisAI

Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal does not restrict unspecified size and amount values, which allows remote attackers to execute arbitrary code or. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-264. Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal does not restrict unspecified size and amount values, which allows remote attackers to execute arbitrary code or cause a denial of service (resource consumption) via unknown vectors. Affected products include: Invensys Wonderware Information Server.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Wonderware Information Server

View all
CVE-2013-0686 CRITICAL
9.3 May 09

Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to read ar
CVE-2014-2380 HIGH
7.8 Aug 28

Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 uses weak encryption, which allows rem
CVE-2012-0226 HIGH
7.5 Apr 02

SQL injection vulnerability in Invensys Wonderware Information Server 4.0 SP1 and 4.5 allows remote attackers to execute
CVE-2014-5397 HIGH
7.5 Aug 28

Cross-site scripting (XSS) vulnerability in Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 throug
CVE-2014-5399 HIGH
7.5 Aug 28

SQL injection vulnerability in Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 allows

CVE-2012-0228 HIGH
7.5 Apr 02

Invensys Wonderware Information Server 4.0 SP1 and 4.5 does not properly implement client controls, which allows remote

CVE-2013-0684 HIGH
7.5 May 09

SQL injection vulnerability in Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal all
CVE-2012-0258 MEDIUM
6.8 Apr 02

Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wonderware A
CVE-2012-0257 MEDIUM
6.8 Apr 02

Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wonderware A
CVE-2012-3005 MEDIUM
6.9 Jul 26

Untrusted search path vulnerability in Invensys Wonderware InTouch 2012 and earlier, as used in Wonderware Application S
CVE-2012-0225 MEDIUM
4.3 Apr 02

Cross-site scripting (XSS) vulnerability in Invensys Wonderware Information Server 4.0 SP1 and 4.5 allows remote attacke
CVE-2013-0688 MEDIUM
4.3 May 09

Cross-site scripting (XSS) vulnerability in Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.

Same weakness CWE-264 – Permissions, Privileges, and Access Controls

View all
CVE-2013-0422 CRITICAL POC
9.8
CVE-2016-10372 CRITICAL POC
9.8
CVE-2014-9583 CRITICAL POC
10.0
CVE-2012-0297 CRITICAL POC
10.0
CVE-2015-7709 CRITICAL POC
10.0
CVE-2014-0514 CRITICAL POC
9.3
CVE-2013-6955 CRITICAL POC
10.0
CVE-2012-0299 CRITICAL POC
10.0

Same technique Privilege Escalation

View all
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2017-5689 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8
CVE-2016-10372 CRITICAL POC
9.8
CVE-2014-9583 CRITICAL POC
10.0
CVE-2012-0297 CRITICAL POC
10.0

Share

CVE-2013-0685 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy