What’s Vulnerable › Vulnerabilities

CVE-2014-9192: Trihedral Engineering Limited VTScada Integer Overflow

• Severity: medium (CVSS 5.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2014-12-11 · updated 2026-06-17
• Weakness: CWE-190

Description

Integer overflow in Trihedral Engineering VTScada (formerly VTS) 6.5 through 9.x before 9.1.20, 10.x before 10.2.22, and 11.x before 11.1.07 allows remote attackers to cause a denial of service (server crash) via a crafted request, which triggers a large memory allocation.

Affected products

• Trihedral VTScada: from 6.5 before 9.1.20; from 10.0 before 10.2.22; from 11.0 before 11.1.07 — fixed in 10.2.22, 11.1.07, 9.1.20

How to fix

Upgrade to a fixed version: Trihedral VTScada 10.2.22, 11.1.07, 9.1.20. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/71591
• http://www.trihedral.com/help/#Op_Welcome/Wel_UpgradeNotes.htm
• https://www.cisa.gov/news-events/ics-advisories/icsa-14-343-02
• http://www.securityfocus.com/bid/71591
• https://ics-cert.us-cert.gov//advisories/ICSA-14-343-02

Get alerted when CVE-2014-9192 or the next vulnerability affects your stack