NREL EnergyPlus, Versions 8.6.0 and possibly prior versions, The application...

5.5 CVSS

Vulnerability Description

NREL EnergyPlus, Versions 8.6.0 and possibly prior versions, The application fails to prevent an exception handler from being overwritten with arbitrary code.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-10974

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://www.us-cert.gov/ics/advisories/icsa-19-204-02

Affected Vendor

National Renewable Energy Laboratory (NREL)

View all reports →

Affected Software

EnergyPlus

Vulnerable Versions:

Versions 8.6.0 and possibly prior versions

Timeline

Official Publish: July 25th, 2019

Last Modified: August 4th, 2024

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-121

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

Initial Access

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1055 Process Injection

Defense Evasion

T1105 Ingress Tool Transfer

Command and Control

T1485 Data Destruction

Impact