Use-after-free vulnerability in Control Microsystems ClearSCADA 2005, 2007, and 2009 before R2.3 and R1.4, as used in SCX before 67 R4.5 and 68 R3.9, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified long strings that trigger heap memory corruption.
結論預警: CVE-2011-3143 綜合評估為高風險（67.3/100）：CVSS 技術影響為嚴重級，利用機率偏高（EPSS 5.99%，百分位 92%） 核心證據: EPSS 顯示該漏洞近期被利用的可能性處於高位。 強制指令: 被利用機率偏高—請盤點暴露面並優先安排修補。
風險隨態勢動態變化；本站持續評估並同步更新本頁展示內容。
EPSS 日更估計相對被利用可能性；百分位表示該 CVE 在已評分漏洞中的相對排名（越高表示相對更嚴重）。
| # | 日期 | 舊 EPSS 分數 | 新 EPSS 分數 | 變化（新 − 舊） |
|---|---|---|---|---|
| 1 | 2026-06-15 | 15.51% | 5.99% | -9.53% |
| 2 | 2026-02-17 | 5.53% | 15.51% | +9.98% |
| 3 | 2026-02-15 | — | 5.53% | — |
完整 EPSS 歷史 （共 12 筆）
該 CVE 的 CVSS 指標。
| 底座分 | 版本 | 嚴重度 | 向量 | 可利用性 | 影響 | 分數來源 |
|---|---|---|---|---|---|---|
| 10.0 | 2.0 | HIGH |
|
10.0 | 10.0 | [email protected] |
| 廠商 | 產品 | 版本 | 原始 CPE |
|---|---|---|---|
| aveva | clearscada | 2005 | cpe:2.3:a:aveva:clearscada:2005:*:*:*:*:*:*:* |
| aveva | clearscada | 2007 | cpe:2.3:a:aveva:clearscada:2007:*:*:*:*:*:*:* |
| aveva | clearscada | 2009 | cpe:2.3:a:aveva:clearscada:2009:*:*:*:*:*:*:* |
| schneider-electric | scx_67 | < r4.5 | cpe:2.3:a:schneider-electric:scx_67:*:*:*:*:*:*:*:* |
| schneider-electric | scx_68 | < r3.9 | cpe:2.3:a:schneider-electric:scx_68:*:*:*:*:*:*:*:* |
| URL | 標籤 |
|---|---|
| http://secunia.com/advisories/44955 | Third Party Advisory |
| http://www.digitalbond.com/scadapedia/vulnerability-notes/heap-overflow-vulnerability/ | Broken Link Third Party Advisory |
| http://www.osvdb.org/72989 | Broken Link |
| http://www.securityfocus.com/bid/46312 | Third Party Advisory VDB Entry |
| http://www.us-cert.gov/control_systems/pdf/ICSA-10-314-01.pdf | Patch Third Party Advisory US Government Resource |
| http://www.us-cert.gov/control_systems/pdf/ICSA-10-314-01A.pdf | Patch Third Party Advisory US Government Resource |