CVE-2011-3492: Azeotech DAQFactory NETB UDP packet stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityThe CVSS 2.0 score is 10.0 with no authentication or interaction required, public exploit code exists, and EPSS is very high, so exploitation could fully compromise an exposed DAQFactory host.

What it is

Azeotech DAQFactory 5.85 build 1853 and earlier contains a stack-based buffer overflow reachable through a crafted NETB packet sent to UDP port 20034. A remote, unauthenticated attacker can crash the service and potentially execute arbitrary code, which matters because DAQFactory is used in industrial data acquisition and control environments.

Impact

An attacker can cause a denial of service and, per the description, execute arbitrary code in the context of the DAQFactory process, giving full control over confidentiality, integrity and availability on the affected host.

Attack surface

The flaw is reached over the network via a single crafted UDP packet to port 20034; the CVSS vector AV:N/AC:L/Au:N/C:C/I:C/A:C indicates no authentication and no user interaction are required.

Exploitation

Public exploit code exists (Exploit-DB 17855 and the advisory reference are tagged Exploit), and EPSS is 0.70909 (99.4th percentile), indicating high likelihood of exploitation activity; the CVE is not listed in CISA KEV.

What to do

• Upgrade DAQFactory to a version later than 5.85 build 1853, or apply the vendor fix referenced in the US-CERT ICS alert, as the primary action.
• If upgrade is not immediately possible, block or restrict UDP port 20034 at network boundaries and host firewalls so only trusted engineering hosts can reach it.
• Segment DAQFactory hosts from general IT and internet-facing networks, and place them behind a firewall or VPN for remote access.
• Monitor the vendor and US-CERT ICS advisory for updated guidance and confirm whether a patched build is available.
• Disable or stop the DAQFactory service on hosts that do not require it.

Detection

• Monitor network traffic for unexpected UDP packets to port 20034, especially from hosts outside the control network.
• Watch for DAQFactory process crashes or restarts in host and application logs, which may indicate exploitation attempts.
• Use IDS/IPS signatures for the known NETB packet exploit and alert on repeated malformed UDP traffic to port 20034.
• Correlate unexpected child processes or outbound connections spawned by the DAQFactory process with packet events to port 20034.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.