CVE-2020-10611: trianglemicroworks scada_data_gateway Type Confusion

Vulnerability summary

CVE-2020-10611 is a critical (CVSS 9.8) Type Confusion vulnerability in trianglemicroworks scada_data_gateway. EPSS estimates a 5.23% chance of exploitation in the next 30 days, higher than 92.4% of scored vulnerabilities.

Timeline

1. 15-04-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

Triangle MicroWorks SCADA Data Gateway 3.02.0697 through 4.0.122, 2.41.0213 through 4.0.122 allows remote attackers to execute arbitrary code due to the lack of proper validation of user-supplied data, which can result in a type confusion condition. Authentication is not required to exploit this vulnerability. Only applicable to installations using DNP3 Data Sets.

• CWE-843Access of Resource Using Incompatible Type ('Type Confusion')The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.