CVE-2015-3977
UnknownEPSS 1.08%
Last modified
CVE-2015-3977 is a vulnerability of currently unknown severity. Buffer overflow in Schneider Electric IMT25 Magnetic Flow DTM before 1.500.004 for the HART Protocol allows remote authenticated users to execute arbitrary code or cause a denial of service (memory corruption) via a crafted HART reply.. EPSS estimates a 1.08% chance of exploitation in the next 30 days.
Description
Buffer overflow in Schneider Electric IMT25 Magnetic Flow DTM before 1.500.004 for the HART Protocol allows remote authenticated users to execute arbitrary code or cause a denial of service (memory corruption) via a crafted HART reply.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Schneider-Electric | Imt25 Magnetic Flow Dtm | <= 1.500.000 |
References
- https://ics-cert.us-cert.gov/advisories/ICSA-15-223-01Third Party Advisory, US Government Resource
- https://ics-cert.us-cert.gov/advisories/ICSA-15-223-01Third Party Advisory, US Government Resource
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2015-3977?
Buffer overflow in Schneider Electric IMT25 Magnetic Flow DTM before 1.500.004 for the HART Protocol allows remote authenticated users to execute arbitrary code or cause a denial of service (memory corruption) via a crafted HART reply.
How severe is CVE-2015-3977?
Severity scoring for CVE-2015-3977 is pending analysis. The EPSS model estimates a 1.08% probability of exploitation in the next 30 days.
How do I fix CVE-2015-3977?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2015
- CVE-2015-3971The debug interface on Janitza UMG 508, 509, 511, 604, and 6…
- CVE-2015-3972The web interface on Janitza UMG 508, 509, 511, 604, and 605…
- CVE-2015-3973Janitza UMG 508, 509, 511, 604, and 605 devices improperly g…
- CVE-2015-3974EasyIO EasyIO-30P-SF controllers with firmware before 0.5.21…
- CVE-2015-3975Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2015-3976Cross-site scripting (XSS) vulnerability in GE Multilink ML8…
- CVE-2015-3978SAP Sybase Unwired Platform Online Data Proxy allows local u…
- CVE-2015-3979Unspecified vulnerability in the Business Rules Framework (C…
- CVE-2015-3980SQL injection vulnerability in the Business Rules Framework …
- CVE-2015-3981SAP NetWeaver RFC SDK allows attackers to obtain sensitive i…
- CVE-2015-3982The session.flush function in the cached_db backend in Djang…
- CVE-2015-3983The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not in…
Are you affected by CVE-2015-3977?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST