Carnegie

A remote out-of-bounds read can occur within the String Array Range Writing component. The issue resides in the `set range matrix on string array()` function located in the `src/Common/opcua types/sopc builtintypes.c` file.

An out-of-bounds read can be triggered remotely within the AddNodes Service component. The issue exists in the `SOPC NodeMgtHelperInternal AddVariableNodeAttributes()` function located in the `src/ClientServer/address space/internal/sopc node mgt helper internal.c` file. This occurs when the `UserAccessLevel` argument is manipulated. The attack requires a high degree of complexity and is considered difficult to execute.

A remote out-of-bounds read can be triggered via the ForwardOpen Handler component. The issue exists in the `CipConnMgrClass::forward open()` function within the `cipconnectionmanager.cc` file, where manipulation of the `product code ` argument allows for the memory read error.

A flaw in the Generic Attribute Logic component allows remote attackers to cause memory corruption. This occurs through the manipulation of the `CipAttribute::GetAttrData()` and `CipAttribute::SetAttrData()` functions within the `ciptypes.h` file.

A remote attack can trigger an out-of-bounds read within the TCP Encapsulation Receive Path component, specifically affecting a function in the `source/src/enet encap/encap.cc` file. An out-of-bounds read occurs when a program reads data past the end of the intended buffer, potentially exposing sensitive information from memory.

A flaw in the Report Sending Path Handler allows a remote attacker to cause a memory error where memory not on the heap is freed. This occurs within the `Reporting RCBWriteAccessHandler()` function located in the src/iec61850/server/mms mapping/reporting.c file.

A remote out-of-bounds read can be triggered in the MMS Request Handler component. The issue resides in the `checkDataSetAccess()` function within the `src/iec61850/server/mms mapping/mms mapping.c` file.

An out-of-bounds write can occur within the `BufWriter::append()` function of the EtherNet IP Message Handler component. This issue allows for remote exploitation through manipulation of the affected function.