CVE-2010-4557

published 2010-12-17

CVE-2010-4557: Buffer overflow in the lm_tcp service in Invensys Wonderware InBatch 8.1 and 9.0, as used in Invensys Foxboro I/A Series Batch 8.1 and possibly other products…

Priority P3 56 critical 10 CVSS 2.0

AV N AC L Au N C C I C A C

EXPLOIT

Buffer overflow in the lm_tcp service in Invensys Wonderware InBatch 8.1 and 9.0, as used in Invensys Foxboro I/A Series Batch 8.1 and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted request to port 9001.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
invensys	foxboro_i_a_series_batch	—	—
invensys	wonderware_inbatch	—	—
invensys	wonderware_inbatch	—	—

Detection & IOCs extracted from sources · hover to see the quote

port 9001↗

command udpsz -C "00004b14 00000000 00000001 00000000 0001 0000" -b 0x61 -T SERVER 9001 0x4b18↗

url https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15707.zip↗

process lm_tcp↗

• → Monitor for large or malformed TCP connections to port 9001 targeting the lm_tcp (Raima Database lockmgr) service; oversized payloads triggering a strcpy-based buffer overflow are the attack vector. ↗
• → The exploit payload begins with the byte sequence '00004b14 00000000 00000001 00000000 0001 0000' followed by a repeated 0x61 fill byte; network signatures should look for this pattern on TCP port 9001. ↗
• → The overflow corrupts two pointers at offsets ESI+ECX+9C and ESI+ECX+A0 within the lm_tcp process; crash or unexpected memset calls in lm_tcp.exe are indicators of exploitation. ↗

• · No vendor patch was available at time of disclosure; affected deployments of Wonderware InBatch 8.1/9.0 and Foxboro I/A Series Batch 8.1 should restrict network access to TCP port 9001 as a compensating control. ↗
• · The vulnerability affects any product embedding the lm_tcp (Raima Database lockmgr) server, not only the named Wonderware/Foxboro products; scope of exposure may be broader than the CVE description implies. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119