Horner Automation vulnerabilities

30 vulnerabilities

Known vulnerabilities in Horner Automation products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 7 products.

Products

7
7.8HighCVE-2021-44462horner automation · cscape envisionrv +1 moreHorner Automation Cscape EnvisionRV Improper Input ValidationThis vulnerability can be exploited by parsing maliciously crafted project files with Horner Automation Cscape EnvisionRV v4.50.3.1 and prior. The issues result from the lack of proper validation of user-supplied data, which can result in reads and writes past the end of allocated data structures. User interaction is required to exploit this vulnerability as an attacker must trick a valid user to open a malicious HMI project file.EPSS0.71%8.4HighCVE-2025-4098horner automation · cscapeOut-of-bounds Read in Horner Automation CscapeHorner Automation Cscape version 10.0 (10.0.415.2) SP1 is vulnerable to an out-of-bounds read vulnerability that could allow an attacker to disclose information and execute arbitrary code on affected installations of Cscape.EPSS0.30%7.5HighCVE-2022-2640horner automation · remote compact controller (rcc) 972 +1 morehorner automation remote compact controller (rcc) 972The Config-files of Horner Automation’s RCC 972 with firmware version 15.40 are encrypted with weak XOR encryption vulnerable to reverse engineering. This could allow an attacker to obtain credentials to run services such as File Transfer Protocol (FTP) and Hypertext Transfer Protocol (HTTP).EPSS0.26%9.8CriticalCVE-2022-2641horner automation · remote compact controller (rcc) 972 +1 morehorner automation remote compact controller (rcc) 972Horner Automation’s RCC 972 with firmware version 15.40 has a static encryption key on the device. This could allow an attacker to perform unauthorized changes to the device, remotely execute arbitrary code, or cause a denial-of-service condition.EPSS0.59%7.5HighCVE-2022-2642horner automation · remote compact controller (rcc) 972 +1 morehorner automation remote compact controller (rcc) 972Horner Automation’s RCC 972 firmware version 15.40 contains global variables. This could allow an attacker to read out sensitive values and variable keys from the device.EPSS0.68%7.8HighCVE-2022-29488horner automation · horner automation cscape csfont +1 moreHorner Automation Cscape CsfontThe affected product is vulnerable to an out-of-bounds read via uninitialized pointer, which may allow an attacker to execute arbitrary code.EPSS0.95%7.8HighCVE-2022-27184horner automation · horner automation cscape csfont +1 moreHorner Automation Cscape CsfontThe affected product is vulnerable to an out-of-bounds write, which may allow an attacker to execute arbitrary code.EPSS0.92%7.8HighCVE-2022-28690horner automation · horner automation cscape csfont +1 moreHorner Automation Cscape CsfontThe affected product is vulnerable to an out-of-bounds write via uninitialized pointer, which may allow an attacker to execute arbitrary code.EPSS0.95%7.8HighCVE-2022-30540horner automation · horner automation cscape csfont +1 moreHorner Automation Cscape CsfontThe affected product is vulnerable to a heap-based buffer overflow via uninitialized pointer, which may allow an attacker to execute arbitrary codeEPSS1.05%7.8HighCVE-2022-3379horner automation · cscape +1 morehorner automation cscapeHorner Automation's Cscape version 9.90 SP7 and prior does not properly validate user-supplied data. If a user opens a maliciously formed FNT file, then an attacker could execute arbitrary code within the current process by writing outside the memory buffer.EPSS0.24%7.8HighCVE-2022-3378horner automation · cscape +1 morehorner automation cscapeHorner Automation's Cscape version 9.90 SP 7 and prior does not properly validate user-supplied data. If a user opens a maliciously formed FNT file, then an attacker could execute arbitrary code within the current process by accessing an uninitialized pointer, leading to an out-of-bounds memory write.EPSS0.25%7.8HighCVE-2022-3377horner automation · cscape +1 morehorner automation cscapeHorner Automation's Cscape version 9.90 SP 6 and prior does not properly validate user-supplied data. If a user opens a maliciously formed FNT file, then an attacker could execute arbitrary code within the current process by accessing an uninitialized pointer, leading to an out-of-bounds memory read.EPSS0.25%8.5HighCVE-2024-9508horner automation · cscapeHorner Automation Cscape Out-of-bounds ReadHorner Automation Cscape contains a memory corruption vulnerability, which could allow an attacker to disclose information and execute arbitrary code.EPSS0.19%8.5HighCVE-2024-12212horner automation · cscapeHorner Automation Cscape Out-of-bounds ReadThe vulnerability occurs in the parsing of CSP files. The issues result from the lack of proper validation of user-supplied data, which could allow reading past the end of allocated data structures, resulting in execution of arbitrary code.EPSS0.20%9.3CriticalCVE-2026-6284horner automation · cscape +2 moreHorner Automation Cscape and XL4, XL7 PLC Weak password requirementsAn attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible.EPSS0.48%8.4HighCVE-2026-12897horner automation · cscapeOut-of-bounds read in Horner Automation CscapeHorner Automation Cscape versions prior to 10.2 SP3 are vulnerable to an Out-of-Bounds Read vulnerability through parsing CSP files. Successful exploitation of this vulnerability could allow an attacker to disclose information and execute arbitrary code.EPSS0.18%7.8HighCVE-2023-0621horner automation · cscape envision rv +1 moreCVE-2023-0621Cscape Envision RV version 4.60 is vulnerable to an out-of-bounds read vulnerability when parsing project (i.e. HMI) files. The product lacks proper validation of user-supplied data, which could result in reads past the end of allocated data structures. An attacker could leverage these vulnerabilities to execute arbitrary code in the context of the current process.EPSS0.23%7.8HighCVE-2023-0623horner automation · cscape envision rv +1 moreCVE-2023-0623Cscape Envision RV version 4.60 is vulnerable to an out-of-bounds write vulnerability when parsing project (i.e. HMI) files. The product lacks proper validation of user-supplied data, which could result in writes past the end of allocated data structures. An attacker could leverage these vulnerabilities to execute arbitrary code in the context of the current process.EPSS0.23%7.8HighCVE-2023-0622horner automation · cscape envision rv +1 moreCVE-2023-0622Cscape Envision RV version 4.60 is vulnerable to an out-of-bounds write vulnerability when parsing project (i.e. HMI) files. The product lacks proper validation of user-supplied data, which could result in writes past the end of allocated data structures. An attacker could leverage these vulnerabilities to execute arbitrary code in the context of the current process.EPSS0.23%7.8HighCVE-2023-31244horner automation · cscape +3 morehorner automation cscapeThe affected product does not properly validate user-supplied data. If a user opens a maliciously formed CSP file, then an attacker could execute arbitrary code within the current process by accessing an uninitialized pointer.EPSS0.23%