CVE-2011-1567: IGSS IGSSdataServer.exe stack buffer overflow via crafted opcodes

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 2.0 score of 10 with network reachability, no authentication, and public exploit code makes this a high-risk flaw for exposed IGSS systems.

What it is

IGSSdataServer.exe in 7-Technologies IGSS 9.00.00.11063 and earlier contains multiple stack-based buffer overflows reachable through crafted commands in several opcodes (0xd, 0x7, 0x8) sent to TCP port 12401. Successful exploitation can crash the service and potentially allow arbitrary code execution on the SCADA server.

Impact

A remote attacker can cause a denial of service against the IGSS data server and may be able to execute arbitrary code in the context of the service. This could disrupt or compromise industrial control operations managed by IGSS.

Attack surface

The flaw is reached over the network via TCP port 12401 by sending specially crafted command payloads; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/Au:N).

Exploitation

Public exploit references exist (Exploit-DB and multiple aluigi.org advisories), and EPSS indicates a high probability of exploitation activity, though the CVE is not listed in CISA KEV.

What to do

• Apply the vendor patch or upgrade IGSS to a version later than 9.00.00.11063 as soon as possible.
• Restrict network access to TCP port 12401 to only trusted hosts and segments; block it from untrusted networks.
• Segment the IGSS server from general IT networks and enforce strict firewall rules around SCADA zones.
• Monitor for and investigate any unexpected crashes or restarts of IGSSdataServer.exe.
• If patching is not immediately possible, consider compensating controls such as an application-layer filter or IPS signature for the affected opcodes.

Detection

• Monitor network traffic to TCP port 12401 for anomalous or malformed command payloads, especially those using opcodes 0xd, 0x7, and 0x8.
• Alert on repeated crashes or service restarts of IGSSdataServer.exe.
• Use IDS/IPS signatures for known IGSS exploit patterns and review logs for connections from unexpected source IPs.
• Baseline normal IGSS client-server communication and flag deviations in command frequency or payload size.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.