CVE-2012-4356

Sielcosistemi Winlog Pro < 2.07.16 - Path Traversal

Title source: rule

Description

Multiple directory traversal vulnerabilities in Sielco Sistemi Winlog Pro SCADA before 2.07.17 and Winlog Lite SCADA before 2.07.17 allow remote attackers to read arbitrary files via port-46824 TCP packets specifying a file-open operation with opcode 0x78 and a .. (dot dot) in a pathname, followed by a file-read operation with opcode (1) 0x96, (2) 0x97, or (3) 0x98.

Exploits (2)

metasploit WORKING POC
by Luigi Auriemma, juan vazquez · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/scada/sielco_winlog_fileaccess.rb
exploitdb WORKING POC
doswindows
https://www.exploit-db.com/exploits/19409

Scores

EPSS 0.6630
EPSS Percentile 98.5%

Classification

CWE
CWE-22
Status draft

Affected Products (50)

sielcosistemi/winlog_pro < 2.07.16
sielcosistemi/winlog_pro
sielcosistemi/winlog_pro
sielcosistemi/winlog_pro
sielcosistemi/winlog_pro
sielcosistemi/winlog_pro
sielcosistemi/winlog_pro
sielcosistemi/winlog_pro
sielcosistemi/winlog_pro
sielcosistemi/winlog_pro
sielcosistemi/winlog_pro
sielcosistemi/winlog_pro
sielcosistemi/winlog_pro
sielcosistemi/winlog_pro
sielcosistemi/winlog_pro
... and 35 more

Timeline

Published Aug 19, 2012
Tracked Since Feb 18, 2026