CVE-2019-10965

In Emerson Ovation OCR400 Controller 3.3.1 and earlier, a heap-based buffer overflow vulnerability in the embedded third-party FTP server involves improper handling of a long command to the FTP service, which may cause memory corruption that halts the controller or leads to remote code execution and escalation of privileges.

Score

CVSS 3.1 8.8 High

Status

Modified - ics-cert@hq.dhs.gov

Published

2019-05-28

Last modified

2024-08-04

Weaknesses

CWE-787

Affected products

• Emerson Ovation Ocr400 Controller (Emerson)
• Ovation Ocr400 Firmware (Emerson)

References

• http://www.securityfocus.com/bid/108499
• https://ics-cert.us-cert.gov/advisories/ICSA-19-148-01