{"id":"CVE-2016-4523","title":"The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to cause a denial of service (","published":"2016-06-09T06:59:04.073Z","updated":"2026-06-16T20:47:42.740Z","severity":"high","cvssScore":7.5,"epss":0.31167,"epssPct":0.98295,"kev":true,"maturity":"weaponized","actionScore":69,"primaryVendor":"trihedral","primaryProduct":"vtscada","cweId":"CWE-125","fixAvailable":false,"tags":["pre-auth","memory","dos","remote","no-ui"],"epssDelta7":-0.0022,"summary":"The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via unspecified vectors.","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssVersion":"3.1","cvssSource":"nvd-primary","cweName":"Out-of-bounds Read","kevAdded":"2022-04-15T00:00:00.000Z","kevDue":"2022-05-06T00:00:00.000Z","kevRansomware":"Unknown","source":"nvd","cna":"icscert","ssvc":{"exploitation":"active","automatable":"yes","impact":"partial"},"sources":{"adp":"2025-10-21T23:55:51.558Z","cna":"2025-10-21T23:55:51.558Z","epss":"2026-11-12","cna_seen":"2026-09-29T10:49:07.330Z"},"cvssCna":null,"hasPatchRef":false,"credits":[],"counts":{"exploitdb":0,"metasploit":0,"nuclei":0,"githubPoc":0},"products":[{"vendor":"trihedral","product":"vtscada","cpe":"cpe:2.3:a:trihedral:vtscada"}],"references":[{"url":"http://www.securityfocus.com/bid/91077","tags":"Broken Link,Third Party Advisory,VDB Entry"},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-16-405","tags":"Third Party Advisory,VDB Entry"},{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-16-159-01","tags":"Third Party Advisory,US Government Resource"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4523","tags":"US Government Resource"}],"exploits":[],"analysis":null,"affectedVersions":[{"vendor":"trihedral","product":"vtscada","version":"*","vsi":"8.0.05","vse":null,"vei":null,"vee":"11.2.02"}],"source_attribution":"NVD (NIST), CVE Program, CISA KEV, FIRST EPSS, OSV. Aggregated by Noroxi."}