CVE-2016-4509

MediumCVSS 6.0/10Last modified Jun 17, 2026

Description

Heap-based buffer overflow in elcsoft.exe in Eaton ELCSoft 2.4.01 and earlier allows remote authenticated users to execute arbitrary code via a crafted file.

Metrics

CVSS 3.0 6.0/10CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/91524
http://www.zerodayinitiative.com/advisories/ZDI-16-408
https://ics-cert.us-cert.gov/advisories/ICSA-16-182-01Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/91524
http://www.zerodayinitiative.com/advisories/ZDI-16-408
https://ics-cert.us-cert.gov/advisories/ICSA-16-182-01Third Party Advisory, US Government Resource

Timeline

Published: Jul 3, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-45109.1The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to bypass authentication and r CVE-2016-45112.8ABB PCM600 before 2.7 uses an improper hash algorithm for the main application password, which makes it easier for local users to obtain sen CVE-2016-45127.3Stack-based buffer overflow in ELCSimulator in Eaton ELCSoft 2.4.01 and earlier allows remote attackers to execute arbitrary code via a long CVE-2016-45136.1Cross-site scripting (XSS) vulnerability in the Schneider Electric PowerLogic PM8ECC module before 2.651 for PowerMeter 800 devices allows r CVE-2016-45147.7Moxa PT-7728 devices with software 3.4 build 15081113 allow remote authenticated users to change the configuration via vectors involving a l CVE-2016-45163.3ABB PCM600 before 2.7 improperly stores the main application password after a password change, which allows local users to obtain sensitive CVE-2016-45186.5OSIsoft PI AF Server before 2016 2.8.0 allows remote authenticated users to cause a denial of service (service outage) via a message.CVE-2016-45199.8Stack-based buffer overflow in Unitronics VisiLogic OPLC IDE before 9.8.30 allows remote attackers to execute arbitrary code via a crafted f CVE-2016-45209.8Schneider Electric Pelco Digital Sentry Video Management System with firmware before 7.14 has hardcoded credentials, which allows remote att CVE-2016-45219.8Sixnet BT-5xxx and BT-6xxx M2M devices before 3.8.21 and 3.9.x before 3.9.8 have hardcoded credentials, which allows remote attackers to obt CVE-2016-45229.8SQL injection vulnerability in Rockwell Automation FactoryTalk EnergyMetrix before 2.20.00 allows remote attackers to execute arbitrary SQL CVE-2016-45237.5The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to cause a denial of service (