CVE-2012-3847: slssvc.exe in Invensys Wonderware SuiteLink in Invensys InTouch 2012 and Wonderware Application Server 2012 al

Routine

MEDIUM 5.0DOWNGRADEDOWNGRADE

CVE-2012-3847 is a medium-severity flaw (CVSS 5.0) affecting intouch, wonderware application server. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

slssvc.exe in Invensys Wonderware SuiteLink in Invensys InTouch 2012 and Wonderware Application Server 2012 allows remote attackers to cause a denial of service (resource consumption) via a long Unicode string, a different vulnerability than CVE-2012-3007.

Why this priority

No elevated risk signals yet

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	5.0 (Medium)
EPSS exploit chance	1.3% (top 29%)
CISA exploited list	No
Weakness	CWE-399
Published	2012-07-05
Last modified	2026-06-16

Publisher (CNA): MITRE · Vendor: invensys

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2012-07-05 03:23 UTCPublished CVE record published
2026-06-16 23:44 UTCUpdated Record last modified

invensys intouch DOWNGRADE

Affected: 2012

Fixed in: no fixed release known

Safe to downgrade to: a release before 2012

1. Check installed version

apt-cache policy intouch || rpm -q intouch || intouch --version

2. No fixed release: DOWNGRADE to a release before 2012 (Debian / Ubuntu)

apt-cache madison intouch sudo apt install intouch=<VERSION_BEFORE_2012> sudo apt-mark hold intouch

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list intouch sudo dnf downgrade intouch-<VERSION_BEFORE_2012> sudo dnf versionlock add intouch

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

invensys wonderware application server DOWNGRADE

Affected: 2012

Fixed in: no fixed release known

Safe to downgrade to: a release before 2012

1. Check installed version

apt-cache policy wonderware-application-server || rpm -q wonderware-application-server || wonderware-application-server --version

2. No fixed release: DOWNGRADE to a release before 2012 (Debian / Ubuntu)

apt-cache madison wonderware-application-server sudo apt install wonderware-application-server=<VERSION_BEFORE_2012> sudo apt-mark hold wonderware-application-server

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list wonderware-application-server sudo dnf downgrade wonderware-application-server-<VERSION_BEFORE_2012> sudo dnf versionlock add wonderware-application-server

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2012-3847?

intouch: downgrade or apply the listed mitigation; wonderware application server: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2012-3847 being exploited?

CVE-2012-3847 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2012-3847 affect?

CVE-2012-3847 affects intouch, wonderware application server. Severity is medium (CVSS 5.0). slssvc.exe in Invensys Wonderware SuiteLink in Invensys InTouch 2012 and Wonderware Application Server 2012 allows remote attackers to cause a denial of service (resource consumption) via a long Unicode string, a different vulnerability tha

How urgent is CVE-2012-3847?

Priority 35/100. No elevated risk signals yet.

Related CVEs

CVE-2023-34982 MEDIUM 5.5 UPGRADE UPGRADE This external control vulnerability, if exploited, could allow a local OS-authenticated user with standard pr
CVE-2023-33873 HIGH 7.8 UPGRADE UPGRADE This privilege escalation vulnerability, if exploited, cloud allow a local OS-authenticated user with standar
CVE-2015-1009 LOW 1.7 UPGRADE UPGRADE Schneider Electric InduSoft Web Studio before 7.1.3.5 Patch 5 and Wonderware InTouch Machine Edition through 7
CVE-2012-3005 MEDIUM 6.9 DOWNGRADE UPGRADE Untrusted search path vulnerability in Invensys Wonderware InTouch 2012 and earlier, as used in Wonderware App
CVE-2012-0258 MEDIUM 6.8 UPGRADE UPGRADE Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wo

References

← Back to latest CVEs