CVE-2022-3377

Published: Nov 15, 2022Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Horner Automation's Cscape version 9.90 SP 6 and prior does not properly validate user-supplied data. If a user opens a maliciously formed FNT file, then an attacker could execute arbitrary code within the current process by accessing an uninitialized pointer, leading to an out-of-bounds memory read.

Affected (8)

Products: Hornerautomation: Cscape

Hornerautomation

1 product

Cscape

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Hornerautomation Cscape	Before 9.90
Hornerautomation Cscape	Version 9.90
Hornerautomation Cscape	Version 9.90 sp1
Hornerautomation Cscape	Version 9.90 sp2
Hornerautomation Cscape	Version 9.90 sp3
Hornerautomation Cscape	Version 9.90 sp4
Hornerautomation Cscape	Version 9.90 sp5
Hornerautomation Cscape	Version 9.90 sp6

Related CWEs

CWE-824

Access of Uninitialized Pointer

The product accesses or uses a pointer that has not been initialized.

References (2)

https://www.cisa.gov/uscert/ics/advisories/icsa-22-277-03

Source: ics-cert@hq.dhs.gov

PatchThird Party AdvisoryUS Government Resource

https://www.cisa.gov/uscert/ics/advisories/icsa-22-277-03

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party AdvisoryUS Government Resource

Timeline

No history available yet.