CVE-2022-3181 Denial of service in VTScada

What is CVE-2022-3181?

CVE-2022-3181 is a high-severity denial of service vulnerability in Trihedral VTScada, published on 2 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An Improper Input Validation vulnerability exists in Trihedral VTScada version 12.0.38 and prior. A specifically malformed HTTP request could cause the affected VTScada to crash. Both local area network (LAN)-only and internet facing systems are affected.

Weakness: CWE-20

Which versions are affected by CVE-2022-3181?

It affects 1 product.

Products include Trihedral Vtscada.

How do I fix CVE-2022-3181?

No fix has been published for CVE-2022-3181 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-3181 being exploited?

There is no known exploitation of CVE-2022-3181 in the wild and no public exploit code.

Other vulnerabilities in Trihedral VTScada

• CVE-2016-4523 Trihedral VTScada (formerly VTS) Denial-of-Service Exploited High 7.5
• CVE-2016-4510 Auth bypass in n/a Critical 9.1
• CVE-2016-4532 Path traversal in n/a Critical 9.1
• CVE-2017-14029 Other in Trihedral Engineering Limited VTScada High 7.8
• CVE-2017-14031 Privilege escalation in Trihedral Engineering Limited VTScada High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5w2r-5335-7hhx.