Unscored severity · published May 13, 2011
CVE-2011-2089
Stack-based buffer overflow in the SetActiveXGUID method in the VersionInfo ActiveX control in GenVersion.dll 8.0.138.0 in the WebHMI subsystem in ICONICS BizViz 9.x before 9.22…
–
CVSS
38.3%
EPSS
No
On KEV
Description
Stack-based buffer overflow in the SetActiveXGUID method in the VersionInfo ActiveX control in GenVersion.dll 8.0.138.0 in the WebHMI subsystem in ICONICS BizViz 9.x before 9.22 and GENESIS32 9.x before 9.22 allows remote attackers to execute arbitrary code via a long string in the argument. NOTE: some of these details are obtained from third party information.
Exploitation
Is it being used?
Exploit prediction (EPSS)38.3% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BI
Bizviz · Iconics
9.0; 9.01; 9.1; 9.2; 9.13; 9.20; +1 more · source: NVD
GE
Genesis32 · Iconics
9.0; 9.1; 9.01; 9.2; 9.13; 9.20; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-2089
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-2089
Vendor Advisory
http://secunia.com/advisories/44417
Exploit
http://www.exploit-db.com/exploits/17240
Exploit
http://www.exploit-db.com/exploits/17269
www.osvdb.org
http://www.osvdb.org/72135
Exploit
http://www.security-assessment.com/files/documents/advisory/ICONICS_WebHMI.pdf
Exploit
http://www.securityfocus.com/bid/47704
More from Bizviz
9.8
CVE-2020-12007
A specially crafted communication packet sent to the affected devices could allow remote code execution and a denial-of-service condition due to a deserialization vulnerability
9.8
CVE-2020-12011
A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition or allow remote code execution
9.1
CVE-2020-12013
A specially crafted WCF client that interfaces to the may allow the execution of certain arbitrary SQL commands remotely
7.5
CVE-2020-12015
A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition due to improper deserialization
7.5
CVE-2020-12009
A specially crafted communication packet sent to the affected device could cause a denial-of-service condition due to a deserialization vulnerability