Ashlar-Vellum Products Out-of-Bounds Write Vulnerability Allowing Arbitrary Code Execution

A vulnerability allowing out-of-bounds write operations has been identified in multiple Ashlar-Vellum products, including Cobalt, Xenon, Argon, Lithium, and Cobalt Share, all versions through 12.6.1204.207. This vulnerability could enable an attacker to execute arbitrary code or disclose information.

Impact

Exploitation of this vulnerability could lead to unauthorized information disclosure or arbitrary code execution.

Remediation

Users are advised to update to Ashlar-Vellum versions 12.6.1204.208 or higher. CISA recommends minimizing network exposure for control system devices, using firewalls to isolate control system networks from business networks, and employing secure remote access methods such as VPNs.