The affected application uses specific functions that could be abused through a crafted project file, which could lead to code execution, system reboot, and system shutdown.
The affected application uses specific functions that could be abused through a crafted project file, which could lead to code execution, system reboot, and system shutdown.
Description: CWE-242 Use of Inherently Dangerous Function
Metrics
Version
Base score
Base severity
Vector
3.1
7.8
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Version:3.1
Base score:7.8
Base severity: HIGH
Vector:
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Metrics Other Info
Impacts
CAPEC ID
Description
Solutions
Configurations
Workarounds
Users are discouraged from using documents from unknown/untrusted sources.
Users are encouraged to store .ctl files in a folder only writeable by admin-level users.
Users are encouraged to operate in “Safe Mode” when loading documents that have been out of their control.
Users are encouraged to apply a document editing password to their documents.
Users should avoid using the Real Time Web-Connect menu items and instead connect to DAQConnect using script.
The affected application uses specific functions that could be abused through a crafted project file, which could lead to code execution, system reboot, and system shutdown.
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
AzeoTech DAQFactory
Project files are stored memory objects in the form of binary serialized data that can later be read and deserialized again to instantiate the original objects in memory. Malicious manipulation of these files may allow an attacker to corrupt memory.