Chuan Wei

**Name of the Vulnerable Software and Affected Versions** libiec61850 versions prior to 1.6.2 **Description** A heap-based buffer overflow exists in the MMS Protocol Workflow component within the `MmsMapping varAccessSpecToObjectReference()` function located in the `src/iec61850/common/iec61850 common.c` file. This issue occurs when the `GetNamedVariableListAttributesResponse.itemId` argument is manipulated, requiring local access to execute the attack. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the `MmsMapping varAccessSpecToObjectReference()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** libiec61850 versions prior to 1.6.2 **Description** A heap-based buffer overflow exists in the ASDU Element Handler component within the `SVReceiver stopThreadless()` function located in the `src/sampled values/sv subscriber.c` file. This issue allows a local attacker to trigger the overflow through specific manipulation. **Recommendations** Update to version 1.6.2. As a temporary mitigation, restrict local access to the system to prevent exploitation of the `SVReceiver stopThreadless()` function.

**Name of the Vulnerable Software and Affected Versions** libiec61850 versions prior to 1.6.2 **Description** A use after free issue exists in the URCB Revalidation component within the `deleteDataSetValuesShadowBuffer()` function located in the src/iec61850/server/mms mapping/reporting.c file. This flaw allows for local manipulation of the system. **Recommendations** Update to version 1.6.2.

**Name of the Vulnerable Software and Affected Versions** open62541 versions prior to 1.5.6 **Description** A heap-based buffer overflow occurs in the `UA Client readNodeClassAttribute()` function within the `src/client/ua client highlevel.c` file. This issue requires local access to be exploited. **Recommendations** Update to a version newer than 1.5.5. As a temporary workaround, restrict access to the `UA Client readNodeClassAttribute()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** open62541 (affected versions not specified) **Description** A use after free issue exists in the `UA Client getRemoteDataTypes()` function within the examples/custom datatype/client types custom.c file. A use after free occurs when a program continues to use a pointer after it has been freed, which can lead to crashes or arbitrary code execution. This issue can be exploited by a local attacker. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libiec61850 versions prior to 1.6.2 **Description** A remote out-of-bounds read can be triggered in the MMS Request Handler component. The issue resides in the `checkDataSetAccess()` function within the `src/iec61850/server/mms mapping/mms mapping.c` file. **Recommendations** Update to version 1.6.2.

**Name of the Vulnerable Software and Affected Versions** mz-automation libiec61850 versions prior to 1.6.2 **Description** A flaw in the Report Sending Path Handler allows a remote attacker to cause a memory error where memory not on the heap is freed. This occurs within the `Reporting RCBWriteAccessHandler()` function located in the src/iec61850/server/mms mapping/reporting.c file. **Recommendations** Update to version 1.6.2.

**Name of the Vulnerable Software and Affected Versions** davenardella snap7 versions prior to 1.4.4 **Description** A security flaw allows for a remote out-of-bounds write, which occurs when the `PDULength` argument is manipulated within the `TSnap7Peer::NegotiatePDULength()` function located in the `src/core/s7 peer.cpp` file. **Recommendations** Update davenardella snap7 to version 1.4.4 or later. As a temporary mitigation, restrict access to the `TSnap7Peer::NegotiatePDULength()` function to prevent remote manipulation of the `PDULength` argument.

**Name of the Vulnerable Software and Affected Versions** liftoff-sr CIPster versions prior to 886a4d090e1c5b0475f0b1c2fe0606a8f0d6a519 **Description** A remote attack can trigger an out-of-bounds read, which occurs when a program reads data outside the intended boundary of a buffer. This issue is located in the `CipAppPath::deserialize symbolic()` function within the source/src/cip/cipepath.cc file. **Recommendations** Apply patch 886a4d090e1c5b0475f0b1c2fe0606a8f0d6a519. As a temporary workaround, restrict access to the `CipAppPath::deserialize symbolic()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** open62541 versions prior to 1.5.6 **Description** A remote issue exists in the Shared Client Library within the `responseReadNamespacesArray()` function located in the `src/client/ua client connect.c` file. Manipulation of the `Server NamespaceArray` argument can lead to a null pointer dereference, which occurs when a program attempts to read or write to a memory address that is null, typically resulting in a crash. **Recommendations** Update to a version newer than 1.5.5. As a temporary workaround, restrict the use of the `responseReadNamespacesArray()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** davenardella snap7 versions prior to 1.4.4 **Description** A flaw in the ReadVar Request Handler component allows for deserialization. The issue resides in the `TS7Worker::PerformFunctionRead()` function within the `src/core/s7 server.cpp` file. Exploitation of this issue requires the attacker to have access to the local network. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** liftoff-sr CIPster versions up to e8e9dba09bf56962807d3504b783ccdb6287f3e4 **Description** An out-of-bounds write can occur within the `BufWriter::append()` function of the EtherNet IP Message Handler component. This issue allows for remote exploitation through manipulation of the affected function. **Recommendations** Deploy patch 3a0159ed43125dcd024a1965f0289cb186bae9ff. As a temporary mitigation, restrict access to the `BufWriter::append()` function.