Ashlar-Vellum Products Heap-Based Buffer Overflow Vulnerability Allowing Arbitrary Code Execution

A heap-based buffer overflow vulnerability has been identified in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share, all versions through 12.6.1204.207. This vulnerability could enable an attacker to execute arbitrary code or disclose information.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution or information disclosure.

Remediation

Users are advised to update to versions 12.6.1204.208 or higher. For Cobalt Share, the same version range applies. CISA also recommends minimizing network exposure for control system devices, using firewalls to isolate control system networks from business networks, and employing secure remote access methods such as VPNs.