Cscape
CVE-2019-13541
HIGH
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
In Horner Automation Cscape 9.90 and prior, an improper input validation vulnerability has been identified that may be exploited by processing files lacking user input validation. This may allow an attacker to access information and remotely execute arbitrary code.
AnalysisAI
In Horner Automation Cscape 9.90 and prior, an improper input validation vulnerability has been identified that may be exploited by processing files lacking user input validation. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-20. In Horner Automation Cscape 9.90 and prior, an improper input validation vulnerability has been identified that may be exploited by processing files lacking user input validation. This may allow an attacker to access information and remotely execute arbitrary code. Affected products include: Hornerautomation Cscape.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Brute force password attacks against Horner Automation XL4/XL7 PLCs and Cscape software allow remote unauthenticated att
Out-of-bounds read in Horner Automation Cscape prior to 10.2 SP3 lets an attacker who supplies a malicious CSP project f
Horner Automation Cscape lacks proper validation of user-supplied data when parsing project files (e.g., HMI). Rated hig
Horner Automation Cscape lacks proper validation of user-supplied data when parsing project files (e.g., HMI). Rated hig
The affected product does not properly validate user-supplied data. Rated high severity (CVSS 7.8), this vulnerability i
The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). Rated hig
The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). Rated hig
The affected application lacks proper validation of user-supplied data when parsing font files (e.g., FNT). Rated high s
Horner Automation Cscape lacks proper validation of user-supplied data when parsing project files (e.g., HMI). Rated hig
The affected application lacks proper validation of user-supplied data when parsing project files (e.g.., CSP). Rated hi
The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). Rated hig
The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). Rated hig
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today