CVE-2019-10965 - In Emerson Ovation OCR400 Controller 3.3.1 and earlier, a heap-based buffer overflow vulnerability in the embedded third-party FTP server involves improper handling of a long command to the FTP service, which may cause memory corruption that halts the controller or leads to remote code execution and escalation of privileges

Back Back to CVE browser

HIGH

In Emerson Ovation OCR400 Controller 3.3.1 and earlier, a heap-based buffer overflow vulnerability in the embedded third-party FTP server involves improper handling of a long command to the FTP service, which may cause memory corruption that halts the controller or leads to remote code execution and escalation of privileges

Published May 28, 2019

8.8

HIGH

CVSS 3.1

EPSS 3.59%

Description

In Emerson Ovation OCR400 Controller 3.3.1 and earlier, a heap-based buffer overflow vulnerability in the embedded third-party FTP server involves improper handling of a long command to the FTP service, which may cause memory corruption that halts the controller or leads to remote code execution and escalation of privileges.

Affected products

Vendor Emerson Product Emerson Ovation OCR400 Controller Default
n/a
- Version
  All versions prior to and including v3.3.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Emerson

Emerson Ovation OCR400 Controller

n/a

Version	Status	Constraints
All versions prior to and including v3.3.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-787

Out-of-bounds Write

References (3)

http://www.securityfocus.com/bid/108499
vdb-entryx_refsource_BIDBroken LinkThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-2679
Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-19-148-01
x_refsource_MISCThird Party AdvisoryUS Government Resource

Link	Providers	Tags
http://www.securityfocus.com/bid/108499		vdb-entryx_refsource_BIDBroken LinkThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-2679		Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-19-148-01		x_refsource_MISCThird Party AdvisoryUS Government Resource