CVE-2023-2186

On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send a specially crafted broadcast message including format string characters to the SCADA Data Gateway to perform unrestricted memory reads.An unauthenticated user can use this format string vulnerability to repeatedly crash the GTWWebMonitor.exe process to DoS the Web Monitor. Furthermore, an authenticated user can leverage this vulnerability to leak memory from the GTWWebMonitor.exe process. This could be leveraged in an exploit chain to gain code execution.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.trellix.com/en-us/about/newsroom/stories/research/industrial-and-manufacturing-cves.html	Third Party Advisory
https://www.trellix.com/en-us/about/newsroom/stories/research/industrial-and-manufacturing-cves.html	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:trianglemicroworks:scada_data_gateway:*:*:*:*:*:*:*:*

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) En la versión menor o igual a v5.01.03 de SCADA Data Gateway de Triangle MicroWorks, un atacante no autenticado puede enviar un mensaje de difusión especialmente diseñado que incluye caracteres de cadena de formato al SCADA Data Gateway para realizar lecturas de memoria sin restricciones. Un usuario no autenticado puede usar esta vulnerabilidad de cadena de formato para bloquear repetidamente el proceso GTWWebMonitor.exe para realizar un DoS al Web Monitor. Además, un usuario autenticado puede aprovechar esta vulnerabilidad para filtrar memoria del proceso GTWWebMonitor.exe. Esto podría ser aprovechado en una cadena de exploits para obtener ejecución de código.

Information

Published : 2023-06-07 07:15

Updated : 2026-10-23 23:10

NVD link : CVE-2023-2186

Mitre link : CVE-2023-2186

CVE.ORG link : CVE-2023-2186

JSON object : View

Products Affected

trianglemicroworks

scada_data_gateway

CWE

CWE-134

Use of Externally-Controlled Format String

{"id": "CVE-2023-2186", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-2186", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-06T20:10:12.309182Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "trellixpsirt@trellix.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "trellixpsirt@trellix.com", "affectedData": [{"vendor": "Triangle MicroWorks", "product": "SCADA Data Gateway", "versions": [{"status": "affected", "version": "5.01.03"}], "defaultStatus": "unaffected"}]}], "published": "2023-06-07T07:15:08.490", "references": [{"url": "https://www.trellix.com/en-us/about/newsroom/stories/research/industrial-and-manufacturing-cves.html", "tags": ["Third Party Advisory"], "source": "trellixpsirt@trellix.com"}, {"url": "https://www.trellix.com/en-us/about/newsroom/stories/research/industrial-and-manufacturing-cves.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "trellixpsirt@trellix.com", "description": [{"lang": "en", "value": "CWE-134"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-134"}]}], "descriptions": [{"lang": "en", "value": "On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send a specially crafted broadcast message including format string characters to the SCADA Data Gateway to perform unrestricted memory reads.An unauthenticated user can use this format string vulnerability to repeatedly crash the GTWWebMonitor.exe process to DoS the Web Monitor. Furthermore, an authenticated user can leverage this vulnerability to leak memory from the GTWWebMonitor.exe process. This could be leveraged in an exploit chain to gain code execution."}, {"lang": "es", "value": "En la versi\u00f3n menor o igual a v5.01.03 de SCADA Data Gateway de Triangle MicroWorks, un atacante no autenticado puede enviar un mensaje de difusi\u00f3n especialmente dise\u00f1ado que incluye caracteres de cadena de formato al SCADA Data Gateway para realizar lecturas de memoria sin restricciones. Un usuario no autenticado puede usar esta vulnerabilidad de cadena de formato para bloquear repetidamente el proceso GTWWebMonitor.exe para realizar un DoS al Web Monitor. Adem\u00e1s, un usuario autenticado puede aprovechar esta vulnerabilidad para filtrar memoria del proceso GTWWebMonitor.exe. Esto podr\u00eda ser aprovechado en una cadena de exploits para obtener ejecuci\u00f3n de c\u00f3digo."}], "lastModified": "2026-10-23T23:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:trianglemicroworks:scada_data_gateway:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A763593D-AA02-4DF7-9D24-A88EB254594D", "versionEndIncluding": "5.01.03"}], "operator": "OR"}]}], "sourceIdentifier": "trellixpsirt@trellix.com"}