TI-2014-04407 Aliases CVE-2014-5407 GHSA-5865-xr2h-gxr4

Schneider Electric VAMPSET Stack-based Buffer Overflow

LOW 21CWE-121Published 2014-09-15 · Updated 2025-11-03

Key facts

Attack vector: Local
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Medium
Impact type: Code execution
Confidentiality · integrity · availability: Partial · Partial · Partial
Fix status: Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

Multiple stack-based buffer overflows in Schneider Electric VAMPSET 2.2.136 and earlier allow local users to cause a denial of service (application halt) via a malformed (1) setting file or (2) disturbance recording file.

Why it matters now

EPSS 0.00371 31st percentileScored 2026-11-07

Fix Fixed VAMPSET (Schneider Electric): 2.2.145

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Schneider Electric	VAMPSET	up to 2.2.136	2.2.145	Patch available	CNA

VAMPSET VendorSchneider Electric Affected up to 2.2.136 Fixed in 2.2.145 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:schneider-electric:vampset::::::::	up to 2.2.136	Vulnerable	Schneider Electric

cpe:2.3:a:schneider-electric:vampset:*:*:*:*:*:*:*:* Versions up to 2.2.136 Vulnerable ·Schneider Electric

Remediation

Fix · CNA VAMPSET (Schneider Electric) Fixed in 2.2.145

Timeline

2026-10-02 Threatist record created from CVE-2014-5407
2026-10-03 Alias added: GHSA-5865-xr2h-gxr4

References

Advisory 1

https://ics-cert.us-cert.gov/advisories/ICSA-14-254-01

Other 3

TI-2017-05570 Memory corruption in Schneider Electric VAMPSET CVSS 3.0MEDIUM 5.5
TI-2014-06900 Multiple buffer overflows in Schneider Electric VAMPSET before 2.2.168 allow local users… CVSS 2.0MEDIUM 4.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences