CVE-2011-0340

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 32.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2011-05-04 · updated 2026-06-16
Weakness: CWE-119

Description

Multiple buffer overflows in the ISSymbol ActiveX control in ISSymbol.ocx 61.6.0.0 and 301.1009.2904.0 in the ISSymbol virtual machine, as distributed in Advantech Studio 6.1 SP6 61.6.01.05, InduSoft Web Studio before 7.0+SP1, and InduSoft Thin Client 7.0, allow remote attackers to execute arbitrary code via a long (1) InternationalOrder, (2) InternationalSeparator, or (3) LogFileName property value; or (4) a long bstrFileName argument to the OpenScreen method.

Affected products

Advantech Studio: 6.1-sp6_61.6.01.05
InduSoft Thin Client: 7.0
InduSoft Web Studio: through 7.0; 6.1, 6.1-sp6

References

http://ics-cert.us-cert.gov/advisories/ICSA-12-249-03
http://secunia.com/advisories/42928
http://secunia.com/advisories/43116
http://secunia.com/secunia_research/2011-36/
http://secunia.com/secunia_research/2011-37/
http://www.advantechdirect.com/eMarketingPrograms/AStudio_Patch/AStudio7.0_Patch_Final.htm
http://www.indusoft.com/hotfixes/hotfixes.php
http://www.securityfocus.com/bid/47596
http://www.us-cert.gov/control_systems/pdf/ICSA-12-137-02.pdf
http://www.vupen.com/english/advisories/2011/1115
http://www.vupen.com/english/advisories/2011/1116
http://ics-cert.us-cert.gov/advisories/ICSA-12-249-03

Get alerted when CVE-2011-0340 or the next vulnerability affects your stack