CVE-2020-10615 Memory corruption in Triangle MicroWorks SCADA Data Gateway 3.02.0697 through 4.0.122, 2.41.0213 through 4.0.122

High 7.5 Published 15 Apr 2020 Updated 4 Aug 2024

Remote attackers can cause a denial-of-service condition in Triangle MicroWorks SCADA Data Gateway via a stack-based buffer overflow without authentication.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-10615?

CVE-2020-10615 is a high-severity memory corruption vulnerability in Triangle MicroWorks SCADA Data Gateway 3.02.0697 through 4.0.122, 2.41.0213 through 4.0.122, published on 15 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Triangle MicroWorks SCADA Data Gateway 3.02.0697 through 4.0.122, 2.41.0213 through 4.0.122 allows remote attackers cause a denial-of-service condition due to a lack of proper validation of the length of user-supplied data, prior to copying it to a fixed-length stack-based buffer. Authentication is not required to exploit this vulnerability.

Weakness: CWE-787, CWE-121

Which versions are affected by CVE-2020-10615?

It affects 1 product.

Products include Trianglemicroworks Scada Data Gateway.

How do I fix CVE-2020-10615?

No fix has been published for CVE-2020-10615 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2020-10615 being exploited?

There is no known exploitation of CVE-2020-10615 in the wild and no public exploit code.

Sources

Also known as GHSA-9w3w-gw8r-v3wj.