Schneider Electric Vampset vulnerabilities

3 CVEs affecting Schneider Electric Vampset, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-7967, published 2017-05-09.

More from Schneider Electric.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2014-8390, published 2015-04-03. Medium severity, CVSS 4.4. EPSS: 0.5% chance of exploitation in the next 30 days. Multiple buffer overflows in Schneider Electric VAMPSET before 2.2.168 allow local users to gain privileges via malformed disturbance-recording data in a (1) CFG or (2) DAT file.
• CVE-2014-5407, published 2014-09-15. Medium severity, CVSS 4.4. EPSS: 0.4% chance of exploitation in the next 30 days. Multiple stack-based buffer overflows in Schneider Electric VAMPSET 2.2.136 and earlier allow local users to cause a denial of service (application halt) via a malformed (1) setting file or (2)…
• CVE-2017-7967, published 2017-05-09. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. All versions of VAMPSET software produced by Schneider Electric, prior to V2.2.189, are susceptible to a memory corruption vulnerability when a corrupted vf2 file is used. This vulnerability causes…