CVE-2011-2530

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

Buffer overflow in RSEds.dll in RSHWare.exe in the EDS Hardware Installation Tool 1.0.5.1 and earlier in Rockwell Automation RSLinx Classic before 2.58 allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed .eds file.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://rockwellautomation.custhelp.com/app/answers/detail/a_id/279194Permissions Required
http://www.kb.cert.org/vuls/id/127584US Government Resource
http://www.kb.cert.org/vuls/id/MAPG-8G9PWXUS Government Resource
http://www.securityfocus.com/bid/48092Third Party Advisory, VDB Entry
http://rockwellautomation.custhelp.com/app/answers/detail/a_id/279194Permissions Required
http://www.kb.cert.org/vuls/id/127584US Government Resource
http://www.kb.cert.org/vuls/id/MAPG-8G9PWXUS Government Resource
http://www.securityfocus.com/bid/48092Third Party Advisory, VDB Entry

Timeline

Published: Jun 22, 2011
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-25314.3Prosody 0.8.x before 0.8.1, when MySQL is used, assigns an incorrect data type to the value column in certain tables, which might allow remo CVE-2011-25325.0The json.decode function in util/json.lua in Prosody 0.8.x before 0.8.1 might allow remote attackers to cause a denial of service (infinite CVE-2011-25333.3The configure script in D-Bus (aka DBus) 1.2.x before 1.2.28 allows local users to overwrite arbitrary files via a symlink attack on an unsp CVE-2011-25347.8Buffer overflow in the clusterip_proc_write function in net/ipv4/netfilter/ipt_CLUSTERIP.c in the Linux kernel before 2.6.39 might allow loc CVE-2011-25355.0chan_iax2.c in the IAX2 channel driver in Asterisk Open Source 1.4.x before 1.4.41.1, 1.6.2.x before 1.6.2.18.1, and 1.8.x before 1.8.4.3, a CVE-2011-25365.0chan_sip.c in the SIP channel driver in Asterisk Open Source 1.4.x before 1.4.41.2, 1.6.2.x before 1.6.2.18.2, and 1.8.x before 1.8.4.4, and CVE-2011-25387.2Cisco Video Communications Server (VCS) before X7.0.3 contains a command injection vulnerability which allows remote, authenticated attacker CVE-2011-25439.0Buffer overflow in the cuil component in Cisco Telepresence System Integrator C Series 4.x before TC4.2.0 allows remote authenticated users CVE-2011-25443.5Cross-site scripting (XSS) vulnerability in the web interface in Cisco TelePresence System MXP Series F9.1 and earlier allows remote authent CVE-2011-25454.3Cross-site scripting (XSS) vulnerability in the SIP implementation on the Cisco SPA8000 and SPA8800 before 6.1.11, SPA2102 and SPA3102 befor CVE-2011-25465.0SQL injection vulnerability in the web-based management interface on Cisco SA 500 series security appliances with software before 2.1.19 all CVE-2011-25479.0The web-based management interface on Cisco SA 500 series security appliances with software before 2.1.19 allows remote authenticated users