CVE-2017-9629

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A Stack-Based Buffer Overflow issue was discovered in Schneider Electric Wonderware ArchestrA Logger, versions 2017.426.2307.1 and prior. The stack-based buffer overflow vulnerability has been identified, which may allow a remote attacker to execute arbitrary code in the context of a highly privileged account.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121 CWE-119

Affected software

Vendor	Product	Versions
n/a	Schneider Electric Wonderware ArchestrA Logger	Schneider Electric Wonderware ArchestrA Logger

References

http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000116/Vendor Advisory
http://www.securityfocus.com/bid/99488Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038836Broken Link, Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-187-04Third Party Advisory, US Government Resource
http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000116/Vendor Advisory
http://www.securityfocus.com/bid/99488Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038836Broken Link, Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-187-04Third Party Advisory, US Government Resource

Timeline

Published: Jul 7, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-96309.4An Improper Authentication issue was discovered in PDQ Manufacturing LaserWash G5 and G5 S Series all versions, LaserWash M5, all versions, CVE-2017-96317.5A Null Pointer Dereference issue was discovered in Schneider Electric Wonderware ArchestrA Logger, versions 2017.426.2307.1 and prior. The n CVE-2017-96329.8A Missing Encryption of Sensitive Data issue was discovered in PDQ Manufacturing LaserWash G5 and G5 S Series all versions, LaserWash M5, al CVE-2017-96338.8An Improper Restriction of Operations within the Bounds of a Memory Buffer issue was discovered in the Continental AG Infineon S-Gold 2 (PMB CVE-2017-96349.8Mitsubishi E-Designer, Version 7.52 Build 344 contains two code sections which may be exploited to allow an attacker to overwrite arbitrary CVE-2017-96353.9Schneider Electric Ampla MES 6.4 provides capability to configure users and their privileges. When Ampla MES users are configured to use Sim CVE-2017-96369.8Mitsubishi E-Designer, Version 7.52 Build 344 contains five code sections which may be exploited to overwrite the heap. This can result in a CVE-2017-96374.1Schneider Electric Ampla MES 6.4 provides capability to interact with data from third party databases. When connectivity to those databases CVE-2017-96389.8Mitsubishi E-Designer, Version 7.52 Build 344 contains six code sections which may be exploited to overwrite the stack. This can result in a CVE-2017-96397.3An issue was discovered in Fuji Electric V-Server Version 3.3.22.0 and prior. A memory corruption vulnerability has been identified (aka imp CVE-2017-96406.3A Path Traversal issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web prior to 6.5; ALC WebCTRL, SiteSc CVE-2017-96418.8PI Coresight 2016 R2 contains a cross-site request forgery vulnerability that may allow access to the PI system. OSIsoft recommends that use