CVE-2023-2186 - CVE House
Back to Database
Status published High CVE-2023-2186

On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an...

Vulnerability Description

On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send a specially crafted broadcast message including format string characters to the SCADA Data Gateway to perform unrestricted memory reads.An unauthenticated user can use this format string vulnerability to repeatedly crash the GTWWebMonitor.exe process to DoS the Web Monitor. Furthermore, an authenticated user can leverage this vulnerability to leak memory from the GTWWebMonitor.exe process. This could be leveraged in an exploit chain to gain code execution.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-2186

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Sam Quinn

References

More from Triangle MicroWorks

View All →
CVE-2023-39468
Triangle MicroWorks SCADA Data Gateway DbasSectorFileToExecuteOnReset Exposed Dangerous Function Remote Code Execution Vulnerability
High 7.2
CVE-2023-39467
Triangle MicroWorks SCADA Data Gateway certificate Information Disclosure Vulnerability
Medium 5.3
CVE-2023-39466
Triangle MicroWorks SCADA Data Gateway get_config Missing Authentication Information Disclosure Vulnerability
Medium 5.3
CVE-2023-39465
Triangle MicroWorks SCADA Data Gateway Use of Hard-coded Cryptograhic Key Information Disclosure Vulnerability
High 7.5
CVE-2023-39464
Triangle MicroWorks SCADA Data Gateway GTWWebMonitorService Unquoted Search Path Remote Code Execution Vulnerability
High 7.2

Affected Vendor

Triangle MicroWorks

View all reports →

Affected Software

SCADA Data Gateway
Vulnerable Versions:
5.01.03

Timeline

Official Publish: June 7th, 2023
Last Modified: January 6th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Weaknesses (CWE)

CWE-134

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.