CVE-2011-3497 service.exe in Measuresoft ScadaPro 4.0.0 and earlier allows remote attackers to execute arbitrary DLL functions via the XF function, possibly related to an insecure exposed method.
HighCVSS 10.0
EPSS 57.1%
Framework module
PoC
- Published
- Updated
- Exploit status
- Public exploit available
Description
service.exe in Measuresoft ScadaPro 4.0.0 and earlier allows remote attackers to execute arbitrary DLL functions via the XF function, possibly related to an insecure exposed method.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| measuresoft scadapro | <= 4.0.0 | No fix listed |
| measuresoft scadapro | = 2.1 | No fix listed |
| measuresoft scadapro | = 2.2 | No fix listed |
| measuresoft scadapro | = 2.3 | No fix listed |
| measuresoft scadapro | = 2.4 | No fix listed |
| measuresoft scadapro | = 2.4.1 | No fix listed |
| measuresoft scadapro | = 2.4.2 | No fix listed |
| measuresoft scadapro | = 2.4.3 | No fix listed |
| measuresoft scadapro | = 2.4.4 | No fix listed |
| measuresoft scadapro | = 2.4.5 | No fix listed |
| measuresoft scadapro | = 2.4.6 | No fix listed |
| measuresoft scadapro | = 2.5 | No fix listed |
| measuresoft scadapro | = 2.5.1 | No fix listed |
| measuresoft scadapro | = 2.5.2 | No fix listed |
| measuresoft scadapro | = 2.5.3 | No fix listed |
| measuresoft scadapro | = 2.5.4 | No fix listed |
| measuresoft scadapro | = 2.5.5 | No fix listed |
| measuresoft scadapro | = 2.6.0 | No fix listed |
| measuresoft scadapro | = 2.7.0 | No fix listed |
| measuresoft scadapro | = 2.7.1 | No fix listed |
| measuresoft scadapro | = 2.7.2 | No fix listed |
| measuresoft scadapro | = 2.8.0 | No fix listed |
| measuresoft scadapro | = 2.9.0 | No fix listed |
| measuresoft scadapro | = 3.1.0 | No fix listed |
| measuresoft scadapro | = 3.2.8 | No fix listed |
Show 20 more
| Product | Affected versions | Fixed in |
|---|---|---|
| measuresoft scadapro | = 3.2.9 | No fix listed |
| measuresoft scadapro | = 3.3.0 | No fix listed |
| measuresoft scadapro | = 3.3.1 | No fix listed |
| measuresoft scadapro | = 3.3.2 | No fix listed |
| measuresoft scadapro | = 3.9.0 | No fix listed |
| measuresoft scadapro | = 3.9.1 | No fix listed |
| measuresoft scadapro | = 3.9.2 | No fix listed |
| measuresoft scadapro | = 3.9.3 | No fix listed |
| measuresoft scadapro | = 3.9.4 | No fix listed |
| measuresoft scadapro | = 3.9.5 | No fix listed |
| measuresoft scadapro | = 3.9.6 | No fix listed |
| measuresoft scadapro | = 3.9.7 | No fix listed |
| measuresoft scadapro | = 3.9.8 | No fix listed |
| measuresoft scadapro | = 3.9.9 | No fix listed |
| measuresoft scadapro | = 3.9.10 | No fix listed |
| measuresoft scadapro | = 3.9.11 | No fix listed |
| measuresoft scadapro | = 3.9.12 | No fix listed |
| measuresoft scadapro | = 3.9.13 | No fix listed |
| measuresoft scadapro | = 3.9.14 | No fix listed |
| measuresoft scadapro | = 3.9.15 | No fix listed |
References
- aluigi.altervista.org exploit
- 8382 third-party-advisory
- www.us-cert.gov us-government-resource