« Volver al listado

CVE-2014-0789

Estado: ModificadaAlta (7.8)—

Multiple buffer overflows in the OPC Automation 2.0 Server Object ActiveX control in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 3.5 and earlier, TLXCDSTOFS33 3.5 and earlier, TLXCDLUOFS33 3.5 and earlier, TLXCDLTOFS33 3.5 and earlier, and TLXCDLFOFS33 3.5 and earlier allow remote attackers to cause a denial of service via long arguments to unspecified functions.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (5)

Schneider-electric — OPC Factory Server TlxcdlfofsSchneider-electric — OPC Factory Server TlxcdltofsSchneider-electric — OPC Factory Server TlxcdluofsSchneider-electric — OPC Factory Server TlxcdstofsSchneider-electric — OPC Factory Server Tlxcdsuofs

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-0789",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Secondary",
        "source": "ics-cert@hq.dhs.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "affectedData": [
        {
          "vendor": "Schneider Electric",
          "product": "OPC Factory Server (OFS)",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "TLXCDSUOFS33 – V3.5"
            },
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "TLXCDSTOFS33 – V3.5"
            },
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "TLXCDLUOFS33 – V3.5"
            },
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "TLXCDLTOFS33 – V3.5"
            },
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "TLXCDLFOFS33 – V3.5"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2014-04-04T15:09:45.917",
  "references": [
    {
      "url": "http://www.schneider-electric.com/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/Content/News/data/en/local/cybersecurity/general_information/2014/03/20140325_vulnerability_disclosure_opc_factory_server.xml",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "http://www2.schneider-electric.com/sites/corporate/en/support/cybersecurity/cybersecurity.page",
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-093-01",
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-093-01",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.schneider-electric.com/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/Content/News/data/en/local/cybersecurity/general_information/2014/03/20140325_vulnerability_disclosure_opc_factory_server.xml",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "ics-cert@hq.dhs.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-122"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple buffer overflows in the OPC Automation 2.0 Server Object ActiveX control in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 3.5 and earlier, TLXCDSTOFS33 3.5 and earlier, TLXCDLUOFS33 3.5 and earlier, TLXCDLTOFS33 3.5 and earlier, and TLXCDLFOFS33 3.5 and earlier allow remote attackers to cause a denial of service via long arguments to unspecified functions."
    },
    {
      "lang": "es",
      "value": "Múltiples desbordamientos de buffer en el control OPC Automation 2.0 Server Object ActiveX en Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 3.5 y anteriores, TLXCDSTOFS33 3.5 y anteriores, TLXCDLUOFS33 3.5 y anteriores, TLXCDLTOFS33 3.5 y anteriores y TLXCDLFOFS33 3.5 y anteriores permiten a atacantes remotos causar una denegación de servicio a través de argumentos largos hacia funciones no especificadas."
    }
  ],
  "lastModified": "2026-06-17T00:03:38.537",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:schneider-electric:opc_factory_server_tlxcdlfofs:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "58A9B25F-0A42-4E55-8253-086C8110B46B",
              "versionEndIncluding": "3.35"
            },
            {
              "criteria": "cpe:2.3:h:schneider-electric:opc_factory_server_tlxcdltofs:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EDAB2AC4-BF6E-4F66-808D-395DA09A2953",
              "versionEndIncluding": "3.35"
            },
            {
              "criteria": "cpe:2.3:h:schneider-electric:opc_factory_server_tlxcdluofs:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BDB23AE4-FE64-4C13-8703-EBF6A419A149",
              "versionEndIncluding": "3.35"
            },
            {
              "criteria": "cpe:2.3:h:schneider-electric:opc_factory_server_tlxcdstofs:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BE9D2AE1-6047-42C0-9BE5-3DA9C7445F6D",
              "versionEndIncluding": "3.35"
            },
            {
              "criteria": "cpe:2.3:h:schneider-electric:opc_factory_server_tlxcdsuofs:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FDF237D6-9874-4669-BBB5-5047D3D0AFDA",
              "versionEndIncluding": "3.35"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov"
}