CVE-2016-4523

HighCVSS 7.5/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via unspecified vectors.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/91077Broken Link, Third Party Advisory, VDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-16-405Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-16-159-01Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/91077Broken Link, Third Party Advisory, VDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-16-405Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-16-159-01Third Party Advisory, US Government Resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4523US Government Resource

Timeline

Published: Jun 9, 2016
Last modified: Jun 17, 2026
Added to CISA KEV: Apr 15, 2022
NVD status: Analyzed

Related CVEs from 2016

CVE-2016-45246.5ABB PCM600 before 2.7 improperly stores OPC Server IEC61850 passwords in unspecified temporary circumstances, which allows local users to ob CVE-2016-45256.6Unspecified ActiveX controls in Advantech WebAccess before 8.1_20160519 allow remote authenticated users to obtain sensitive information or CVE-2016-45267.5ABB DataManagerPro 1.x before 1.7.1 allows local users to gain privileges by replacing a DLL file in the package directory.CVE-2016-45273.3ABB PCM600 before 2.7 improperly stores PCM600 authentication credentials, which allows local users to obtain sensitive information via unsp CVE-2016-45285.0Buffer overflow in Advantech WebAccess before 8.1_20160519 allows local users to cause a denial of service via a crafted DLL file.CVE-2016-45297.3An unspecified ActiveX control in Schneider Electric SoMachine HVAC Programming Software for M171/M172 Controllers before 2.1.0 allows remot CVE-2016-45306.5OSIsoft PI SQL Data Access Server (aka OLE DB) 2016 1.5 allows remote authenticated users to cause a denial of service (service outage and d CVE-2016-45317.3Rockwell Automation FactoryTalk EnergyMetrix before 2.20.00 does not invalidate credentials upon a logout action, which makes it easier for CVE-2016-45329.1Directory traversal vulnerability in the WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote att CVE-2016-45337.8Heap-based buffer overflow in WECON LeviStudio allows remote attackers to execute arbitrary code via a crafted file.CVE-2016-45343.0The McAfee VirusScan Console (mcconsol.exe) in McAfee VirusScan Enterprise 8.8.0 before Hotfix 1123565 (8.8.0.1546) on Windows allows local CVE-2016-45357.5Integer signedness error in the AV engine before DAT 8145, as used in McAfee LiveSafe 14.0, allows remote attackers to cause a denial of ser