CVE-2017-6043 Denial of service in Trihedral VTScada

What is CVE-2017-6043?

CVE-2017-6043 is a high-severity denial of service vulnerability in Trihedral VTScada, published on 21 Jun 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A Resource Consumption issue was discovered in Trihedral VTScada Versions prior to 11.2.26. The client does not properly validate the input or limit the amount of resources that are utilized by an attacker, which can be used to consume more resources than are available.

Weakness: CWE-400

Which versions are affected by CVE-2017-6043?

It affects 1 product.

Products include Trihedral Vtscada.

How do I fix CVE-2017-6043?

No fix has been published for CVE-2017-6043 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2017-6043 being exploited?

There is no known exploitation of CVE-2017-6043 in the wild and no public exploit code.

Other vulnerabilities in Trihedral VTScada

• CVE-2016-4523 Trihedral VTScada (formerly VTS) Denial-of-Service Exploited High 7.5
• CVE-2016-4510 Auth bypass in n/a Critical 9.1
• CVE-2016-4532 Path traversal in n/a Critical 9.1
• CVE-2017-14029 Other in Trihedral Engineering Limited VTScada High 7.8
• CVE-2017-14031 Privilege escalation in Trihedral Engineering Limited VTScada High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f9xv-m3hp-2jq7.