Horner Automation Cscape EnvisionRV Improper Input Validation

published 2022-03-25 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-31299

cvss: 7.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.7%; EPSS 0.7% chance of exploitation in 30 days, percentile 53%
public exploits: 0; none known

This vulnerability can be exploited by parsing maliciously crafted project files with Horner Automation Cscape EnvisionRV v4.50.3.1 and prior. The issues result from the lack of proper validation of user-supplied data, which can result in reads and writes past the end of allocated data structures. User interaction is required to exploit this vulnerability as an attacker must trick a valid user to open a malicious HMI project file.

Patch / fix

links 1

cisa.gov/uscert/ics/advisories/icsa-21-355-02 advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-21-355-02 updated 2021-12-21 cvss 7.8

Horner Automation Cscape EnvisionRV

Horner Automation Cscape EnvisionRV <= 4.50.3.1
affected: mitigation “Horner Automation recommends affected users update to the latest version of Cscape Envision RV (Version 4.60).” hornerautomation.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 18 mo ago (2025-04-16)

Exploit prediction

0.71% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	3.1	7.1	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
NVD	2.0	5.8	AV:N/AC:M/Au:N/C:P/I:P/A:N

Affected products

Horner Automation Cscape EnvisionRV

Classification

Weakness

CWE-20 Improper Input Validation

References

cisa.gov /uscert/ics/advisories/icsa-21-355-02
mitigation, patch, third-party-advisory, us-government-resource

Sources

CVE List CVE-2021-44462
NVD CVE-2021-44462

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary