Sign-up

ID

VAR-201511-0335


CVE

CVE-2015-3977


TITLE

Schneider Electric IMT25 Magnetic Flow DTM for the HART Protocol Buffer Overflow Vulnerability

Trust: 1.4

sources: IVD: 91c5db52-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2015-07629 // CNNVD: CNNVD-201511-255

DESCRIPTION

Buffer overflow in Schneider Electric IMT25 Magnetic Flow DTM before 1.500.004 for the HART Protocol allows remote authenticated users to execute arbitrary code or cause a denial of service (memory corruption) via a crafted HART reply. Schneider Electric IMT25 Magnetic Flow DTM (Device Type Manager) is a device type management software library from Schneider Electric, France

Trust: 2.52

sources: NVD: CVE-2015-3977 // JVNDB: JVNDB-2015-005925 // CNVD: CNVD-2015-07629 // IVD: 91c5db52-2351-11e6-abef-000c29c66e3d // VULHUB: VHN-81938 // VULMON: CVE-2015-3977

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 91c5db52-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2015-07629

AFFECTED PRODUCTS

vendor:schneider electricmodel:imt25 magnetic flow dtmscope:lteversion:1.500.000

Trust: 1.0

vendor:schneider electricmodel:imt25 magnetic flow dtmscope:ltversion:1.500.004

Trust: 0.8

vendor:schneidermodel:electric imt25 magnetic flow dtmscope:lteversion:<=1.500.000

Trust: 0.6

vendor:schneider electricmodel:imt25 magnetic flow dtmscope:eqversion:1.500.000

Trust: 0.6

vendor:imt25 magnetic flow dtmmodel: - scope:eqversion:*

Trust: 0.2

sources: IVD: 91c5db52-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2015-07629 // JVNDB: JVNDB-2015-005925 // CNNVD: CNNVD-201511-255 // NVD: CVE-2015-3977

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-3977
value: HIGH

Trust: 1.0

NVD: CVE-2015-3977
value: HIGH

Trust: 0.8

CNVD: CNVD-2015-07629
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201511-255
value: HIGH

Trust: 0.6

IVD: 91c5db52-2351-11e6-abef-000c29c66e3d
value: HIGH

Trust: 0.2

VULHUB: VHN-81938
value: HIGH

Trust: 0.1

VULMON: CVE-2015-3977
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2015-3977
severity: HIGH
baseScore: 7.7
vectorString: AV:A/AC:L/AU:S/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 5.1
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2015-07629
severity: HIGH
baseScore: 7.7
vectorString: AV:A/AC:L/AU:S/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 5.1
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 91c5db52-2351-11e6-abef-000c29c66e3d
severity: HIGH
baseScore: 7.7
vectorString: AV:A/AC:L/AU:S/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 5.1
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-81938
severity: HIGH
baseScore: 7.7
vectorString: AV:A/AC:L/AU:S/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 5.1
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: IVD: 91c5db52-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2015-07629 // VULHUB: VHN-81938 // VULMON: CVE-2015-3977 // JVNDB: JVNDB-2015-005925 // CNNVD: CNNVD-201511-255 // NVD: CVE-2015-3977

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.9

sources: VULHUB: VHN-81938 // JVNDB: JVNDB-2015-005925 // NVD: CVE-2015-3977

THREAT TYPE

specific network environment

Trust: 0.6

sources: CNNVD: CNNVD-201511-255

TYPE

Buffer overflow

Trust: 0.8

sources: IVD: 91c5db52-2351-11e6-abef-000c29c66e3d // CNNVD: CNNVD-201511-255

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-005925

PATCH
title:SEVD-2015-215-01url:http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-215-01
Trust: 0.8
title:Patch for Schneider Electric IMT25 Magnetic Flow DTM for the HART Protocol Buffer Overflow Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/66874
Trust: 0.6
title:Schneider Electric IMT25 Magnetic Flow DTM for the HART Protocol Buffer Overflow Vulnerability Fixurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=58743
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2015-07629 // 
            
            
            
            JVNDB: JVNDB-2015-005925 // 
            
            
            
            CNNVD: CNNVD-201511-255

EXTERNAL IDS
db:NVDid:CVE-2015-3977
Trust: 3.4
db:ICS CERTid:ICSA-15-223-01
Trust: 3.2
db:SCHNEIDERid:SEVD-2015-215-01
Trust: 2.4
db:CNNVDid:CNNVD-201511-255
Trust: 0.9
db:CNVDid:CNVD-2015-07629
Trust: 0.8
db:JVNDBid:JVNDB-2015-005925
Trust: 0.8
db:IVDid:91C5DB52-2351-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:VULHUBid:VHN-81938
Trust: 0.1
db:VULMONid:CVE-2015-3977
Trust: 0.1
sources:
            
            
            IVD: 91c5db52-2351-11e6-abef-000c29c66e3d // 
            
            
            
            CNVD: CNVD-2015-07629 // 
            
            
            
            VULHUB: VHN-81938 // 
            
            
            
            VULMON: CVE-2015-3977 // 
            
            
            
            JVNDB: JVNDB-2015-005925 // 
            
            
            
            CNNVD: CNNVD-201511-255 // 
            
            
            
            NVD: CVE-2015-3977

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsa-15-223-01
Trust: 3.3
url:http://download.schneider-electric.com/files?p_doc_ref=sevd-2015-215-01
Trust: 2.4
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-3977
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-3977
Trust: 0.8
url:https://cwe.mitre.org/data/definitions/119.html
Trust: 0.1
url:http://tools.cisco.com/security/center/viewalert.x?alertid=40412
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2015-07629 // 
            
            
            
            VULHUB: VHN-81938 // 
            
            
            
            VULMON: CVE-2015-3977 // 
            
            
            
            JVNDB: JVNDB-2015-005925 // 
            
            
            
            CNNVD: CNNVD-201511-255 // 
            
            
            
            NVD: CVE-2015-3977

SOURCES
db:IVDid:91c5db52-2351-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2015-07629
db:VULHUBid:VHN-81938
db:VULMONid:CVE-2015-3977
db:JVNDBid:JVNDB-2015-005925
db:CNNVDid:CNNVD-201511-255
db:NVDid:CVE-2015-3977

LAST UPDATE DATE
2025-04-12T23:12:59.078000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2015-07629date:2015-11-18T00:00:00
db:VULHUBid:VHN-81938date:2015-11-16T00:00:00
db:VULMONid:CVE-2015-3977date:2015-11-16T00:00:00
db:JVNDBid:JVNDB-2015-005925date:2015-11-17T00:00:00
db:CNNVDid:CNNVD-201511-255date:2015-11-16T00:00:00
db:NVDid:CVE-2015-3977date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:IVDid:91c5db52-2351-11e6-abef-000c29c66e3ddate:2015-11-18T00:00:00
db:CNVDid:CNVD-2015-07629date:2015-11-18T00:00:00
db:VULHUBid:VHN-81938date:2015-11-15T00:00:00
db:VULMONid:CVE-2015-3977date:2015-11-15T00:00:00
db:JVNDBid:JVNDB-2015-005925date:2015-11-17T00:00:00
db:CNNVDid:CNNVD-201511-255date:2015-11-16T00:00:00
db:NVDid:CVE-2015-3977date:2015-11-15T03:59:00.123