Read the docs
TI-2021-20071 Aliases CVE-2021-44462GHSA-6fp8-84r4-prgm

Horner Automation Cscape EnvisionRV Improper Input Validation

Priority LOW 37CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

This vulnerability can be exploited by parsing maliciously crafted project files with Horner Automation Cscape EnvisionRV v4.50.3.1 and prior. The issues result from the lack of proper validation of user-supplied data, which can result in reads and writes past the end of allocated data structures. User interaction is required to exploit this vulnerability as an attacker must trick a valid user to open a malicious HMI project file.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00713 53rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Horner AutomationCscape EnvisionRVup to v4.50.3.1—No fix listedCNA
  • Cscape EnvisionRV VendorHorner Automation Affected up to v4.50.3.1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:hornerautomation:cscape_envisionrv:*:*:*:*:*:*:*:*up to 4.50.3.1VulnerableHorner Automation
  • cpe:2.3:a:hornerautomation:cscape_envisionrv:*:*:*:*:*:*:*:* Versions up to 4.50.3.1 Vulnerable ·Horner Automation

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-44462
  2. 2026-10-03 Alias added: GHSA-6fp8-84r4-prgm

References

Patch 1

  • TI-2023-13871 Stack-based buffer overflow in Horner Automation Cscape CVSS 3.1HIGH 7.8
  • TI-2023-13171 Use after free in Horner Automation Cscape CVSS 3.1HIGH 7.8
  • TI-2023-15827 Out-of-bounds read in Horner Automation Cscape CVSS 3.1HIGH 7.8
  • TI-2023-15821 Horner Automation Cscape Out-of-bounds Write CVSS 3.1HIGH 7.8
  • TI-2023-15585 Out-of-bounds read in Horner Automation Cscape CVSS 3.1HIGH 7.8
  • TI-2023-15579 Out-of-bounds read in Horner Automation Cscape CVSS 3.1HIGH 7.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences