Vulnerability Details : CVE-2011-2963
TCPUploadServer.exe in Progea Movicon 11.2 before Build 1084 does not require authentication for critical functions, which allows remote attackers to obtain sensitive information, delete files, execute arbitrary programs, or cause a denial of service (crash) via a crafted packet to TCP port 10651.
Vulnerability category: BypassGain privilegeDenial of service
Exploit prediction scoring system (EPSS) score for CVE-2011-2963
Probability of exploitation activity in the next 30 days: 14.25%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 96 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2011-2963
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST |
CWE ids for CVE-2011-2963
-
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.Assigned by: nvd@nist.gov (Primary)
References for CVE-2011-2963
-
http://www.us-cert.gov/control_systems/pdf/ICSA-11-056-01A.pdf
404 - File Not Found | CISAPatch;US Government Resource
-
http://www.exploit-db.com/exploits/17034
Progea Movicon 11 - 'TCPUploadServer' Remote File System - Windows remote ExploitExploit
-
http://www.securityfocus.com/bid/46907
Progea Movicon 'TCPUploadServer.exe' Security Bypass VulnerabilityExploit
-
http://www.us-cert.gov/control_systems/pdf/ICSA-11-056-01.pdf
404 - File Not Found | CISAPatch;US Government Resource
Products affected by CVE-2011-2963
- cpe:2.3:a:progea:movicon:11.2:*:*:*:*:*:*:*