Vulnerability Spotlight: Wellin Tech ICS platform vulnerable to information disclosure, buffer overflow vulnerabilities
Summary: Cisco Talos discovered two vulnerabilities in WellinTech's KingHistorian industrial control systems time-series database: an information disclosure flaw (TALOS-2022-1683 / CVE-2022-45124) in the user authentication function, where a captured authentication packet contains all the information needed to steal a target user's username and password, and a buffer overflow (TALOS-2022-1674 / CVE-2022-43663) in a software DLL that can be triggered by sending a malicious packet to the targeted machine. Talos confirmed KingHistorian version 35.01.00.05 could be exploited by these vulnerabilities, worked with WellinTech on an update, and released Snort rule 61093 to detect exploitation attempts.
Why it matters: A single captured authentication packet hands an adversary a valid username and password for an ICS data manager, and the buffer overflow can be triggered by one malicious packet sent to the targeted machine.
Read the original at Cisco Talos ↗
- Topics
- OT / ICS & Critical Infrastructure
- Mentions
- CVE-2022-43663CVE-2022-45124
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026