CVE-2014-9206

MediumCVSS 6.9/10Last modified Jun 17, 2026

Description

Stack-based buffer overflow in Device Type Manager (DTM) 3.1.6 and earlier for Schneider Electric Invensys SRD Control Valve Positioner devices 960 and 991 allows local users to gain privileges via a malformed DLL file.

Metrics

CVSS 2.0 6.9/10AV:L/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://download.schneider-electric.com/files?p_File_Id=745435959&p_File_Name=SEVD-2015-050-01.pdfVendor Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-15-055-03Third Party Advisory, US Government Resource
http://download.schneider-electric.com/files?p_File_Id=745435959&p_File_Name=SEVD-2015-050-01.pdfVendor Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-15-055-03Third Party Advisory, US Government Resource

Timeline

Published: Mar 14, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-92076.9Untrusted search path vulnerability in CmnView.exe in CIMON CmnView 2.14.0.1 and 3.x before UltimateAccess 3.02 allows local users to gain p CVE-2014-920810.0Multiple stack-based buffer overflows in unspecified DLL files in Advantech WebAccess before 8.0.1 allow remote attackers to execute arbitra CVE-2014-92096.9Untrusted search path vulnerability in the Clean Utility application in Rockwell Automation FactoryTalk Services Platform before 2.71.00 and CVE-2014-92116.1ClickDesk version 4.3 and below has persistent cross site scripting CVE-2014-92124.3Multiple cross-site scripting (XSS) vulnerabilities in Altitude uAgent in Altitude uCI (Unified Customer Interaction) 7.5 allow remote attac CVE-2014-92157.5SQL injection vulnerability in the CheckEmail function in includes/functions.class.php in PBBoard 3.0.1 before 20141128 allows remote attack CVE-2014-92175.0Graylog2 before 0.92 allows remote attackers to bypass LDAP authentication via crafted wildcards.CVE-2014-92185.0libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.7, 4.1.x before 4.1.14.8, and 4.2.x before 4.2.13.1 allows remote attackers to ca CVE-2014-92194.3Cross-site scripting (XSS) vulnerability in the redirection feature in url.php in phpMyAdmin 4.2.x before 4.2.13.1 allows remote attackers t CVE-2014-92207.5SQL injection vulnerability in OpenVAS Manager before 4.0.6 and 5.x before 5.0.7 allows remote attackers to execute arbitrary SQL commands v CVE-2014-92215.0strongSwan 4.5.x through 5.2.x before 5.2.1 allows remote attackers to cause a denial of service (invalid pointer dereference) via a crafted CVE-2014-922210.0AllegroSoft RomPager 4.34 and earlier, as used in Huawei Home Gateway products and other vendors and products, allows remote attackers to ga