Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2012-0257: Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wo

46
This month
MEDIUM 6.8UPGRADEUPGRADEUPGRADE

CVE-2012-0257 is a medium-severity flaw (CVSS 6.8) affecting archestra application object toolkit, foxboro control software, infusion control edition. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wonderware Application Server 2012 and earlier, Foxboro Control Software 3.1 and earlier, InFusion CE/FE/SCADA 2.5 and earlier, Wonderware Information Server 4.5 and earlier, ArchestrA Application Object Toolkit 3.2 and earlier, and InTouch 10.0 through 10.5 might allow remote attackers to execute arbitrary code via a long string to the Ope

Why this priority

  • No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score6.8 (Medium)
EPSS exploit chance3.2% (top 12%)
CISA exploited listNo
WeaknessCWE-119
Published2012-04-02
Last modified2026-06-16
Publisher (CNA): CERT/CC · Vendor: invensys

Share: LinkedIn · X · Reddit

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

invensys archestra application object toolkit UPGRADE
Affected: <= 3.2
Fixed in: newer than 3.2
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy archestra-application-object-toolkit || rpm -q archestra-application-object-toolkit || archestra-application-object-toolkit --version
2. UPGRADE to newer than 3.2 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade archestra-application-object-toolkit
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade archestra-application-object-toolkit
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
invensys foxboro control software UPGRADE
Affected: <= 3.1
Fixed in: newer than 3.1
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy foxboro-control-software || rpm -q foxboro-control-software || foxboro-control-software --version
2. UPGRADE to newer than 3.1 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade foxboro-control-software
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade foxboro-control-software
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
invensys infusion control edition UPGRADE
Affected: <= 2.5
Fixed in: newer than 2.5
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy infusion-control-edition || rpm -q infusion-control-edition || infusion-control-edition --version
2. UPGRADE to newer than 2.5 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade infusion-control-edition
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade infusion-control-edition
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
invensys infusion foundation edition UPGRADE
Affected: <= 2.5
Fixed in: newer than 2.5
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy infusion-foundation-edition || rpm -q infusion-foundation-edition || infusion-foundation-edition --version
2. UPGRADE to newer than 2.5 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade infusion-foundation-edition
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade infusion-foundation-edition
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
invensys infusion scada UPGRADE
Affected: <= 2.5
Fixed in: newer than 2.5
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy infusion-scada || rpm -q infusion-scada || infusion-scada --version
2. UPGRADE to newer than 2.5 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade infusion-scada
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade infusion-scada
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
invensys intouch DOWNGRADE
Affected: 10.0 · 10.5
Fixed in: no fixed release known
Safe to downgrade to: a release before 10.0
1. Check installed version
apt-cache policy intouch || rpm -q intouch || intouch --version
2. No fixed release: DOWNGRADE to a release before 10.0 (Debian / Ubuntu)
apt-cache madison intouch sudo apt install intouch=<VERSION_BEFORE_10.0> sudo apt-mark hold intouch
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list intouch sudo dnf downgrade intouch-<VERSION_BEFORE_10.0> sudo dnf versionlock add intouch
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2012-0257?

archestra application object toolkit: upgrade to newer than 3.2; foxboro control software: upgrade to newer than 3.1; infusion control edition: upgrade to newer than 2.5. Exact commands for each OS are on this page.

Is CVE-2012-0257 being exploited?

CVE-2012-0257 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2012-0257 affect?

CVE-2012-0257 affects archestra application object toolkit, foxboro control software, infusion control edition. Severity is medium (CVSS 6.8). Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wonderware Application Server 2012 and earlier, Foxboro Control Software 3.1 and earlier, InFusion CE/FE/SCADA 2.5 and earlier, Wond

How urgent is CVE-2012-0257?

Priority 46/100. No elevated risk signals yet.

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.