{"id":"CVE-2016-4523","kind":"vulnerability","aliases":["CVE-2016-4523"],"related":[],"title":"Trihedral VTScada (formerly VTS): Trihedral VTScada (formerly VTS) Denial-of-Service Vulnerability","description":"The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via unspecified vectors.","summary":"Trihedral VTScada (formerly VTS) has a flaw in its WAP interface that lets remote attackers crash or stall it with a denial-of-service. CISA lists it as actively exploited.","severity":"high","cvss":7.5,"epss":0.31167,"exploited":true,"exploited_at":"2022-04-15T00:00:00+00:00","products":[{"name":"Trihedral VTScada (formerly VTS)","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","industrial-control","scada","vendor","vtscada"],"not_affected_if":["no-wap-interface-exposed"],"how_to_check":null,"fix":"Apply the updates per vendor instructions, as CISA requires; the sources do not name the fixed version.","status":"open","published_at":"2016-06-09T10:59:04+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:17:51+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-10-23T21:17:51Z","model":"claude-haiku-5-5","output":{"fix":"Apply the updates per vendor instructions, as CISA requires; the sources do not name the fixed version.","reach":"network","impact":"low","summary":"Trihedral VTScada (formerly VTS) has a flaw in its WAP interface that lets remote attackers crash or stall it with a denial-of-service. CISA lists it as actively exploited.","category":"vendor","who_cares":["vtscada","industrial-control","scada"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Remote attacker causes denial-of-service on the VTScada server","analyst_note":"Find the vendor advisory and fixed version for VTScada WAP DoS CVE-2016-4523 and whether WAP is enabled by default; check the CISA KEV entry for the due date.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-wap-interface-exposed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000461,"input_tokens":2850,"output_tokens":351,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2016':15A,18A '-4523':16A,19A '11':73C '11.2.02':76C '8':70C 'activ':60B 'allow':77C 'applic':92C 'attack':45B,79C 'bound':89C 'caus':81C 'cisa':56B 'control':27B 'crash':46B,93C 'cve':14A,17A 'denial':10A,53B,83C 'denial-of-servic':9A,52B 'exploit':24B,61B 'flaw':37B 'former':3A,7A,33B,68C 'formerly':22A 'industri':26B 'industrial-control':25B 'interfac':41B,64C 'let':43B 'list':57B 'out-of-bound':86C 'read':90C 'remot':44B,78C 'scada':28B 'servic':12A,55B,85C 'stall':48B 'trihedr':1A,5A,31B,66C 'trihedral':20A 'unspecifi':95C 'vector':96C 'vendor':29B 'via':94C 'vts':4A,8A,23A,34B,69C 'vtscada':2A,6A,21A,30B,32B,67C 'vulner':13A 'wap':40B,63C 'x':71C,74C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2016-06-09T10:59:04+00:00","kev":{"dateAdded":"2022-04-15","dueDate":"2022-05-06","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2016-4523","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-4523","severity":null,"published_at":"2022-04-15T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T13:39:31+00:00","note":null},{"source":"epss","external_id":"CVE-2016-4523","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-4523","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2016-4523","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4523","severity":null,"published_at":"2016-06-09T10:59:04+00:00","modified_at":"2026-06-17T00:47:42+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}