CVE-2012-5409
AscoServer.exe in the server in Siemens SiPass integrated MP2.6 and earlier does not properly handle IOCP RPC messages received over an Ethernet network, which allows remote attackers to write data...
Affects 1 product across 1 vendor.
Parent class for buffer-related vulnerabilities where operations exceed buffer boundaries.
Show all 12
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
CVE-2012-5409 affects the AscoServer.exe component in Siemens SiPass integrated MP2.6 and earlier, allowing remote attackers to execute arbitrary code via crafted IOCP RPC messages. This vulnerability has a CVSS score of 10.0, indicating critical severity.
BSID: BS-2012-GLOBAL-171073-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2012-5409?
What is the CVSS score for CVE-2012-5409?
Is CVE-2012-5409 actively exploited?
How do I remediate CVE-2012-5409?
What systems are affected by CVE-2012-5409?
What NERC-CIP standard applies to CVE-2012-5409?
What IEC 62443 requirement maps to CVE-2012-5409?
| CVE ID | CVE-2012-5409 |
|---|---|
| BSID | BS-2012-GLOBAL-171073-C BreachSpider Global ID |
| CVSS Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
| Published | 2012-11-01 |
| Last Modified | 2026-06-16 |
| ICS Relevance | 70% |
| Weakness (CWE) | |
| Verticals | |
| Source | NVD |
AscoServer.exe in the server in Siemens SiPass integrated MP2.6 and earlier does not properly handle IOCP RPC messages received over an Ethernet network, which allows remote attackers to write data to any memory location and consequently execute arbitrary code via crafted messages, as demonstrated by an arbitrary pointer dereference attack or a buffer overflow attack.
Source: NIST NVD / MITRE CVE Database
The vulnerability arises from improper handling of IOCP RPC messages received over an Ethernet network. An attacker can send crafted messages to write data to any memory location, leading to arbitrary code execution. This can result in complete system compromise, including unauthorized access, data manipulation, and potential disruption of physical processes.
Exploitation Likelihood: CRITICAL
| Vendor | Product | Affected Versions |
|---|---|---|
| Siemens | Sipass Integrated | ≤ mp2.6 |
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | ⚠ Available — Reference |
| PoC Code | Not confirmed |
Implement network segmentation to isolate the affected SiPass integrated systems from untrusted networks. Use firewalls to restrict access to the necessary ports and protocols used by AscoServer.exe.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. A network rule is only drafted when a concrete on-the-wire signature can be grounded in the advisory.
This CVE violates CIP-007-R2 because it allows unauthorized access to the control system, potentially leading to the compromise of critical assets and operations.
This CVE maps to SR 7.6 because it involves a vulnerability that can be exploited remotely to gain control of the system, which is a significant risk to the security of industrial control systems.
Drafted by AI and not validated for your network. Test in an isolated environment before any production deployment. Compensating control only - does not replace vendor patch.
AI Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 94c38cea67e4a48288eb82e81eb0d1eaebba78b36b2d9ae05304e154f969d2645a94dc27edb2ecb0aaf556d89ce435c9d3c9efc2b1617f39c29a7cc72ae1293d |
Critical Severity - Know Your Exposure
A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Create a free account →