CVE-2011-4535
TurboPower Abbrevia < 3.05 - Buffer Overflow via Crafted ZIP File
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2011-4535.
PoCs published by Metasploit, mr_me, including Metasploit module exploits/windows/fileformat/scadaphone_zip.
AI-analyzed exploit summary This exploit targets a stack-based buffer overflow in ScadaTEC ScadaPhone v5.3.11.1230 by crafting a malicious ZIP file. The payload is executed when the victim loads the file, leveraging an egghunter and SEH overwrite for reliable exploitation.
Description
Buffer overflow in TurboPower Abbrevia before 4.0, as used in ScadaTEC ScadaPhone 5.3.11.1230 and earlier, ScadaTEC ModbusTagServer 4.1.1.81 and earlier, and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted ZIP file.
Exploits (3)
This exploit targets a stack-based buffer overflow in ScadaTEC ScadaPhone v5.3.11.1230 by crafting a malicious ZIP file. The payload is executed when the victim loads the file, leveraging an egghunter and SEH overwrite for reliable exploitation.
This exploit leverages a buffer overflow vulnerability in ScadaTEC ModbusTagServer and ScadaPhone to execute arbitrary code via a maliciously crafted ZIP file. It includes ROP chains and shellcode to bypass DEP on Windows XP SP3 for ScadaPhone and a direct SEH overwrite for ModbusTagServer.
This Metasploit module exploits a stack-based buffer overflow in ScadaTEC ScadaPhone 5.3.11.1230 via a maliciously crafted ZIP file. It uses an egghunter and SEH overwrite to achieve arbitrary code execution.