CVE-2012-4356
Winlog Pro < 2.07.17 - Unauthenticated Path Traversal via TCP Port 46824 File Operations
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2012-4356.
PoCs published by Luigi Auriemma, juan vazquez, including Metasploit module auxiliary/scanner/scada/sielco_winlog_fileaccess.
AI-analyzed exploit summary The exploit demonstrates multiple vulnerabilities in Sielco Sistemi Winlog SCADA/HMI software, including code execution via function pointer manipulation, stack overflow, directory traversal, and memory corruption. It provides specific commands to trigger these vulnerabilities using a custom tool (udpsz).
Description
Multiple directory traversal vulnerabilities in Sielco Sistemi Winlog Pro SCADA before 2.07.17 and Winlog Lite SCADA before 2.07.17 allow remote attackers to read arbitrary files via port-46824 TCP packets specifying a file-open operation with opcode 0x78 and a .. (dot dot) in a pathname, followed by a file-read operation with opcode (1) 0x96, (2) 0x97, or (3) 0x98.
Exploits (2)
The exploit demonstrates multiple vulnerabilities in Sielco Sistemi Winlog SCADA/HMI software, including code execution via function pointer manipulation, stack overflow, directory traversal, and memory corruption. It provides specific commands to trigger these vulnerabilities using a custom tool (udpsz).
This Metasploit module exploits a directory traversal vulnerability in Sielco Sistemi Winlog's Runtime.exe service via TCP port 46824. It allows remote file access by sending crafted packets to read arbitrary files from the target system.