Skip to content
CVE Tracker
Back

CVE-2014-9190

Schneider Electric Wonderware InTouch Access Anywhere Server Buffer Overflow

Critical10.0EPSS 6.2%
Published
Updated
Reserved
Assigned by
icscert

Description

Stack-based buffer overflow in Schneider Electric Wonderware InTouch Access Anywhere Server 10.6 and 11.0 allows remote attackers to execute arbitrary code via a request for a filename that does not exist.

Scores

CVSS scores of CVE-2014-9190, by who scored it
Scored byCVSSScoreVector
icscertCNA (assigner)2.0Critical10.0AV:N/AC:L/Au:N/C:C/I:C/A:C
NVDNVD · Modified2.0High10.0AV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS (exploitation in 30 days)
6.2% · top 6.5% of all CVEs (2 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 10.0.

Weakness

Affected products

  • Schneider Electric · InTouch Access Anywhere Server

    • affected 10.6
    • affected 11.0

What to do

Solution: Schneider Electric has released a security update that mitigates the stack-based buffer overflow vulnerability in Wonderware’s InTouch Access Anywhere Server product, Versions 10.6 and 11.0. Schneider Electric’s security updates for Version 10.6 and Version 11.0 are available at the following location with a user account: https://wdnresource.wonderware.com/tracking/confirmdownload.aspx?id=3001&url=https://wdnresource... https://wdnresource.wonderware.com/tracking/confirmdownload.aspx Schneider Electric has released a security bulletin titled “InTouch Access Anywhere Server Security Vulnerability, LFSEC00000104” to announce the security update, which is available at the following location: https://gcsresource.invensys.com/support/docs/_SecurityBulletins/Security_Bulletin_LFSEC00000104.pdf

References (3)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .