CVE-2019-8262

{"id": "CVE-2019-8262", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2019-03-05T15:29:00.477", "references": [{"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf", "source": "vulnerability@kaspersky.com"}, {"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf", "tags": ["Third Party Advisory"], "source": "vulnerability@kaspersky.com"}, {"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-940818.pdf", "source": "vulnerability@kaspersky.com"}, {"url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-008-ultravnc-heap-based-buffer-overflow/", "tags": ["Third Party Advisory"], "source": "vulnerability@kaspersky.com"}, {"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-131-11", "source": "vulnerability@kaspersky.com"}, {"url": "https://www.us-cert.gov/ics/advisories/icsa-20-161-06", "tags": ["Third Party Advisory", "US Government Resource"], "source": "vulnerability@kaspersky.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}, {"type": "Secondary", "source": "vulnerability@kaspersky.com", "description": [{"lang": "en", "value": "CWE-122"}]}], "descriptions": [{"lang": "en", "value": "UltraVNC revision 1203 has multiple heap buffer overflow vulnerabilities in VNC client code inside Ultra decoder, which results in code execution. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1204."}, {"lang": "es", "value": "UltraVNC, en su revisi\u00f3n 1203, tiene m\u00faltiples vulnerabilidades de desbordamiento de b\u00fafer de memoria din\u00e1mica (heap) en el c\u00f3digo del cliente VNC dentro del decodificador Ultra, lo que resulta en la ejecuci\u00f3n de c\u00f3digo. Este ataque parece ser explotable mediante conectividad de red. Esto se ha solucionado en la revisi\u00f3n 1204."}], "lastModified": "2021-06-28T12:15:08.317", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:uvnc:ultravnc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "555D034F-3D64-4ED1-9B63-F8D59199E99C", "versionEndExcluding": "1.2.2.3"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:siemens:sinumerik_access_mymachine\\/p2p:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D9345335-DF62-4472-93CD-E2C85453F91E", "versionEndExcluding": "4.8"}, {"criteria": "cpe:2.3:a:siemens:sinumerik_pcu_base_win10_software\\/ipc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7498412D-79FD-43FE-AD9B-5820FB5CF7D8", "versionEndExcluding": "14.00"}, {"criteria": "cpe:2.3:a:siemens:sinumerik_pcu_base_win7_software\\/ipc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1F603341-03C5-46CA-8A74-EC5A50135194", "versionEndIncluding": "12.01"}], "operator": "OR"}]}], "sourceIdentifier": "vulnerability@kaspersky.com"}