Carnegie

**Name of the Vulnerable Software and Affected Versions** Systerel S2OPC versions prior to 1.7.4 **Description** A remote out-of-bounds read can occur within the String Array Range Writing component. The issue resides in the `set range matrix on string array()` function located in the `src/Common/opcua types/sopc builtintypes.c` file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the `set range matrix on string array()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Systerel S2OPC versions prior to 1.7.4 **Description** An out-of-bounds read can be triggered remotely within the AddNodes Service component. The issue exists in the `SOPC NodeMgtHelperInternal AddVariableNodeAttributes()` function located in the `src/ClientServer/address space/internal/sopc node mgt helper internal.c` file. This occurs when the `UserAccessLevel` argument is manipulated. The attack requires a high degree of complexity and is considered difficult to execute. **Recommendations** Install the patch with identifier aafbd37d381b618312ebdf5ddf57027f62c14fdd for versions prior to 1.7.4.

A weakness has been identified in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This affects the function CipConnMgrClass::forward open of the file cipconnectionmanager.cc of the component ForwardOpen Handler. Executing a manipulation of the argument product code can lead to out-of-bounds read. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. This patch is called ea870a274bf68dfaa3f511f20e2fff6778fb7b74. A patch should be applied to remediate this issue.

**Name of the Vulnerable Software and Affected Versions** liftoff-sr CIPster version 1802525be27d33e19a9a83c163e331a1d13b1892 **Description** A flaw in the Generic Attribute Logic component allows remote attackers to cause memory corruption. This occurs through the manipulation of the `CipAttribute::GetAttrData()` and `CipAttribute::SetAttrData()` functions within the `ciptypes.h` file. **Recommendations** Install patch e745d9d4a8ca3a13689066983a1269fe1e567674 for version 1802525be27d33e19a9a83c163e331a1d13b1892.

A security vulnerability has been detected in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This impacts an unknown function of the file source/src/enet encap/encap.cc of the component TCP Encapsulation Receive Path. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is e8e9dba09bf56962807d3504b783ccdb6287f3e4. To fix this issue, it is recommended to deploy a patch.

**Name of the Vulnerable Software and Affected Versions** mz-automation libiec61850 versions prior to 1.6.2 **Description** A flaw in the Report Sending Path Handler allows a remote attacker to cause a memory error where memory not on the heap is freed. This occurs within the `Reporting RCBWriteAccessHandler()` function located in the src/iec61850/server/mms mapping/reporting.c file. **Recommendations** Update to version 1.6.2.

**Name of the Vulnerable Software and Affected Versions** libiec61850 versions prior to 1.6.2 **Description** A remote out-of-bounds read can be triggered in the MMS Request Handler component. The issue resides in the `checkDataSetAccess()` function within the `src/iec61850/server/mms mapping/mms mapping.c` file. **Recommendations** Update to version 1.6.2.

**Name of the Vulnerable Software and Affected Versions** liftoff-sr CIPster versions up to e8e9dba09bf56962807d3504b783ccdb6287f3e4 **Description** An out-of-bounds write can occur within the `BufWriter::append()` function of the EtherNet IP Message Handler component. This issue allows for remote exploitation through manipulation of the affected function. **Recommendations** Deploy patch 3a0159ed43125dcd024a1965f0289cb186bae9ff. As a temporary mitigation, restrict access to the `BufWriter::append()` function.