CVE-2015-0980

EUVD-2015-0988 · Published Mar 14, 2015

Format string vulnerability in BACnOPCServer.exe in the SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to execute arbitrary code via format string specifiers in a request.

Technologies

Scadaengine Bacnet Opc Server

Weaknesses

CWE-20

CVSS scores

v2.09.0AV:N/AC:L/Au:N/C:P/I:P/A:C

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access

T1190Exploit Public-Facing Application

References

https://ics-cert.us-cert.gov/advisories/ICSA-15-069-03

Potentially impacted assets

See if this affects your attack surface