CVE-2016-4523: Trihedral VTScada WAP interface out-of-bounds read causes DoS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityRemote, unauthenticated denial of service against a SCADA/HMI product that is listed in CISA KEV with a high EPSS score, though impact is limited to availability.

What it is

The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 performs an out-of-bounds read on unspecified input, crashing the application. Because the WAP interface is network-reachable and the flaw needs no credentials, an unauthenticated attacker can repeatedly take the SCADA/HMI server down.

Impact

An attacker gains a remote denial of service: the VTScada application crashes, disrupting monitoring and control operations until it is restarted. No confidentiality or integrity impact is described; the effect is availability loss.

Attack surface

Reached over the network through the WAP interface (CVSS vector AV:N/PR:N/UI:N), so no authentication and no user interaction are required. The description does not specify which requests trigger the out-of-bounds read.

Exploitation

CVE-2016-4523 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-04-15), indicating exploitation in the wild, and EPSS gives a 30-day probability of 0.30651 (98th percentile). No public exploit code or ransomware use is documented in this record.

What to do

• Upgrade VTScada to 11.2.02 or later, or apply the vendor update referenced in ICSA-16-159-01.
• Restrict network access to the WAP interface to trusted hosts and management networks using firewall or ACL rules.
• Segment the VTScada host from general IT and internet-facing networks per ICS advisory guidance.
• Monitor and restart the VTScada service automatically so a crash does not leave the system offline.
• Track the CISA KEV remediation due date (2022-05-06) and confirm patched status.

Detection

• Alert on unexpected VTScada process crashes or service restarts and correlate them with inbound WAP interface traffic.
• Log and review connections to the WAP interface, flagging source IPs outside the expected management range.
• Use network monitoring to detect repeated or malformed requests to the WAP port that precede a crash.
• Check host and application logs for out-of-bounds or access-violation errors in the VTScada process.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.