Multiple vulnerabilities in SCADA Data Gateway

Published: 2014-05-31 | Updated: 2020-08-10

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2014-2342 CVE-2014-2343
CWE-ID	CWE-20
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	SCADA Data Gateway Server applications / SCADA systems
Vendor	Triangle MicroWorks, Inc.

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU41595

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2014-2342

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Triangle MicroWorks SCADA Data Gateway before 3.00.0635 allows remote attackers to cause a denial of service (excessive data processing) via a crafted DNP3 packet.

Mitigation

Install update from vendor's website.

Vulnerable software versions

SCADA Data Gateway: 2.50 - 3.00.0630

External links

http://ics-cert.us-cert.gov/advisories/ICSA-14-149-01
http://www.trianglemicroworks.com/products/scada-data-gateway/what%27s-new

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Input validation error

EUVDB-ID: #VU41596

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2014-2343