CVE-2019-8268

Published: Mar 8, 2019Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

UltraVNC revision 1206 has multiple off-by-one vulnerabilities in VNC client code connected with improper usage of ClientConnection::ReadString function, which can potentially result code execution. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1207.

Affected (4)

Products: Uvnc: Ultravnc · Siemens: Sinumerik Access Mymachine/p2p, Sinumerik Pcu Base Win10 Software/ipc, Sinumerik Pcu Base Win7 Software/ipc

Uvnc

1 product

Ultravnc

Siemens

3 products

Sinumerik Access Mymachine/p2p

Sinumerik Pcu Base Win10 Software/ipc

Sinumerik Pcu Base Win7 Software/ipc

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Uvnc Ultravnc	Before 1.2.2.3

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Siemens Sinumerik Access Mymachine/p2p	Before 4.8
Siemens Sinumerik Pcu Base Win10 Software/ipc	Before 14.00
Siemens Sinumerik Pcu Base Win7 Software/ipc	Up to 12.01