CVE-2023-2186: scada data gateway through 5.01.03 (inclusive); +1 more affected products

Affected technology

scada data gateway · through 5.01.03 (inclusive)
trianglemicroworks

SCADA Data Gateway · 5.01.03
Triangle MicroWorks

Description’s affected range: version <= v5.01.03

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated attacker can send a specially crafted broadcast message including format string characters to the SCADA Data Gateway to perform unrestricted memory reads.An unauthenticated user can use this format string vulnerability to repeatedly crash the GTWWebMonitor.exe process to DoS the Web Monitor. Vendor/CNA’s CVSS 3.1 assessment (base score 8.2/10) rates confidentiality impact as low; integrity impact as none; availability impact as high. NVD’s CVSS 3.1 assessment (base score 9.8/10) rates confidentiality, integrity and availability impact as high.