CVE-2011-1563: DATAC RealFlex RealWin HMI stack buffer overflows via port 910 packets

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a CVSS 2.0 base score of 10, public exploit references, and very high EPSS make this an urgent exposure for any internet- or network-reachable RealWin HMI.

What it is

DATAC RealFlex RealWin 2.1 (Build 6.1.10.10) and earlier contains multiple stack-based buffer overflows in its HMI application, triggered by long or crafted fields in several FCS protocol packets sent to port 910. Because the flaws are reachable over the network without authentication and can lead to arbitrary code execution, they are serious for any exposed industrial HMI deployment.

Impact

A remote attacker can execute arbitrary code with the privileges of the RealWin HMI process, potentially taking over the host and disrupting or manipulating the controlled process.

Attack surface

Reached over the network by sending crafted packets to TCP port 910; the CVSS vector (AV:N/AC:L/Au:N) and description indicate no authentication or user interaction is required.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.746, ~99.5th percentile) and multiple references are tagged Exploit, including public advisories and an Exploit-DB entry, indicating working exploit code is publicly available.

What to do

• Apply the vendor fix or upgrade RealWin past 2.1 Build 6.1.10.10; if no patch exists, isolate or retire the affected HMI.
• Block or strictly restrict TCP port 910 to trusted engineering hosts using host and network firewalls.
• Place RealWin HMI systems behind a segmented control network with no direct internet or untrusted-network exposure.
• Monitor vendor and US-CERT ICS advisories for updated guidance and replacement versions.
• Where feasible, run the HMI under a least-privilege account and restrict its outbound network access.

Detection

• Alert on network connections to TCP port 910 from hosts outside the expected engineering or control segment.
• Inspect IDS/IPS or packet capture for malformed or oversized FCS packet fields (login, tag list, telemetry, script) targeting port 910.
• Monitor the RealWin HMI process for crashes or unexpected restarts that could indicate failed exploitation attempts.
• Watch for unusual child processes or outbound connections originating from the HMI host after port 910 traffic.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.