CVE-2023-1150
published 2023-06-26CVE-2023-1150: Uncontrolled resource consumption in Series WAGO 750-3x/-8x products may allow an unauthenticated remote attacker to DoS the MODBUS server with specially…
PriorityP346high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.93%
56.8th percentile
Uncontrolled resource consumption in Series WAGO 750-3x/-8x products may allow an unauthenticated remote attacker to DoS the MODBUS server with specially crafted packets.
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wago | 750-332 | <= FW10 | — |
| wago | 750-362_000-001_firmware | < fw11 | fw11 |
| wago | 750-362_040-000_firmware | < fw11 | fw11 |
| wago | 750-362_firmware | < fw11 | fw11 |
| wago | 750-362_xxx-xxx | <= FW10 | — |
| wago | 750-363_040-000_firmware | < fw11 | fw11 |
| wago | 750-363_firmware | < fw11 | fw11 |
| wago | 750-363_xxx-xxx | <= FW10 | — |
| wago | 750-364_040-010_firmware | < fw11 | fw11 |
| wago | 750-364_xxx-xxx | <= FW10 | — |
| wago | 750-365_040-010_firmware | < fw11 | fw11 |
| wago | 750-365_xxx-xxx | <= FW10 | — |
| wago | 750-823 | <= FW10 | — |
| wago | 750-823_firmware | < fw11 | fw11 |
| wago | 750-832_000-002_firmware | < fw11 | fw11 |
| wago | 750-832_firmware | < fw11 | fw11 |
| wago | 750-832_xxx-xxx | <= FW10 | — |
| wago | 750-862 | <= FW10 | — |
| wago | 750-862_firmware | < fw11 | fw11 |
| wago | 750-890_025-000_firmware | < fw11 | fw11 |
| wago | 750-890_025-001_firmware | < fw11 | fw11 |
| wago | 750-890_025-002_firmware | < fw11 | fw11 |
| wago | 750-890_040-000_firmware | < fw11 | fw11 |
| wago | 750-890_firmware | < fw11 | fw11 |
| wago | 750-890_xxx-xxx | <= FW10 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-phj7-pw7p-pxq8: Uncontrolled resource consumption in Series WAGO 750-3x/-8x products may allow an unauthenticated remote attacker to DoS the MODBUS server with specia
ghsa_unreviewed·2023-06-26
CVE-2023-1150 [HIGH] CWE-400 GHSA-phj7-pw7p-pxq8: Uncontrolled resource consumption in Series WAGO 750-3x/-8x products may allow an unauthenticated remote attacker to DoS the MODBUS server with specia
Uncontrolled resource consumption in Series WAGO 750-3x/-8x products may allow an unauthenticated remote attacker to DoS the MODBUS server with specially crafted packets.
Red Hat
kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c
vendor_redhat·2024-02-23·CVSS 7.8
CVE-2023-52464 [HIGH] CWE-805 kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c
kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c
In the Linux kernel, the following vulnerability has been resolved:
EDAC/thunderx: Fix possible out-of-bounds string access
Enabling -Wstringop-overflow globally exposes a warning for a common bug
in the usage of strncat():
drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr':
drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound 1024 equals destination size [-Werror=stringop-overflow=]
1136 | strncat(msg, other, OCX_MESSAGE_SIZE);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
...
1145 | strncat(msg, other, OCX_MESSAGE_SIZE);
...
1150 | strncat(msg, other, OCX_MESSAGE_SIZE);
...
Apparently the author of this driver expected strncat() to behave the
way that strlcat() does, which use
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-06-26
Published