Description
Stack-based buffer overflow in Sielco Sistemi Winlog Pro 2.07.00 and earlier, when Run TCP/IP server is enabled, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a crafted 0x02 opcode to TCP port 46823.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Sielco Sistemi Winlog Buffer Overflow
exploit/windows/scada/winlog_runtime
Exploit-DB 2
- Sielco Sistemi Winlog - Remote Buffer Overflow (Metasploit) EDB-17430 · remote · Jun 21, 2011 · verified
- Sielco Sistemi Winlog 2.07.00 - Stack Overflow EDB-15992 · dos · Jan 14, 2011
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- ICSA-11-017-02 Sielco Sistemi WinLog Stack Overflow CISA ICS & IT advisories · Jun 9, 2025
References
- 8280 third-party-advisory
- http://aluigi.org/adv/winlog_1-adv.txt
- ADV-2011-0126 vdb-entry
- 42894 third-party-advisory
- 70418 vdb-entry
- VU#496040 third-party-advisory
- 45813 vdb-entry
- http://www.us-cert.gov/control_systems/pdf/ICSA-11-017-02.pdf
- 15992 exploit
- winlog-tcpip-bo(64716) vdb-entry