CVE-2023-2186 - On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send a specially crafted broadcast message including format string characters to the SCADA Data Gateway to perform unrestricted memory reads.An unauthenticated user can use this format string vulnerability to repeatedly crash the GTWWebMonitor.exe process to DoS the Web Monitor

Back Back to CVE browser

CRITICAL

On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send a specially crafted broadcast message including format string characters to the SCADA Data Gateway to perform unrestricted memory reads.An unauthenticated user can use this format string vulnerability to repeatedly crash the GTWWebMonitor.exe process to DoS the Web Monitor

Published Jun 7, 2023

9.8

CRITICAL

CVSS 3.1

EPSS 0.71%

Description

On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send a specially crafted broadcast message including format string characters to the SCADA Data Gateway to perform unrestricted memory reads.An unauthenticated user can use this format string vulnerability to repeatedly crash the GTWWebMonitor.exe process to DoS the Web Monitor. Furthermore, an authenticated user can leverage this vulnerability to leak memory from the GTWWebMonitor.exe process. This could be leveraged in an exploit chain to gain code execution.

Affected products

Vendor Triangle MicroWorks Product SCADA Data Gateway Default
unaffected
- Version
  5.01.03
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Triangle MicroWorks

SCADA Data Gateway

unaffected

Version	Status	Constraints
5.01.03	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-134

References (1)

https://www.trellix.com/en-us/about/newsroom/stories/research/industrial-and-manufacturing-cves.html
Third Party Advisory

Link	Providers	Tags
https://www.trellix.com/en-us/about/newsroom/stories/research/industrial-and-manufacturing-cves.html		Third Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner trellix

Published Jun 7, 2023

Updated Jan 6, 2025

Reserved Apr 19, 2023

Link CVE-2023-2186

CISA Vulnrichment

Updated Jan 6, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2023-2186

Red Hat

Severity n/a

Public date n/a

Links CVE-2023-2186