cbcvebase.
CVE-2012-5409
published 2012-11-01

CVE-2012-5409: AscoServer.exe in the server in Siemens SiPass integrated MP2.6 and earlier does not properly handle IOCP RPC messages received over an Ethernet network, which…

PriorityP266critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
15.79%
96.5th percentile
AscoServer.exe in the server in Siemens SiPass integrated MP2.6 and earlier does not properly handle IOCP RPC messages received over an Ethernet network, which allows remote attackers to write data to any memory location and consequently execute arbitrary code via crafted messages, as demonstrated by an arbitrary pointer dereference attack or a buffer overflow attack.

Affected

1 ranges
VendorProductVersion rangeFixed in
siemenssipass_integrated<= mp2.6—

Detection & IOCsextracted from sources · hover to see the quote

port4343/TCP↗
processAscoServer.exe↗
  • →Detect unauthenticated crafted TCP packets sent to port 4343 targeting AscoServer.exe IOCP RPC message handling; no authentication is required to reach this port. ↗
  • →Monitor for exploitation technique targeting Thread Environment Block (TEB) exception handler pointer overwrite following an access violation in AscoServer.exe threads. ↗
  • →Alert on large memcpy operations (e.g., n=0xBB8 / 3000 bytes) originating from IOCP message handling within AscoServer.exe, particularly where the destination pointer is user-controlled. ↗
  • →Block or alert on all inbound connections to TCP port 4343 from untrusted/external network segments to prevent exploitation of the SiPass server. ↗
  • ·The vulnerability exists in the Ethernet Bus communication path; exploitation is possible over LAN/WAN/PSTN wherever AscoServer.exe is reachable on port 4343/TCP without authentication. ↗
  • ·Even though ASLR is present, thread data block addresses are stable due to multiple identical threads being spawned, reducing the effectiveness of address randomization as a mitigation. ↗
  • ·Exploitation runs under the SYSTEM account context, meaning successful exploitation grants full system privileges. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.