CVE-2011-2962: Multiple stack-based buffer overflows in Invensys Wonderware Information Server 3.1, 4.0, and 4.0 SP1 allow...

Security readout for executives and security teams

CVE-2011-2962 affects Invensys Wonderware Information Server 3.1, 4.0, and 4.0 SP1. The reported issue is multiple stack-based buffer overflows in two unspecified ActiveX controls. A remote attacker could crash the component and may be able to run arbitrary code. Published sources do not confirm active exploitation. Most likely exposure is legacy Wonderware Information Server deployments with the vulnerable ActiveX controls available to users or systems that browse to the server. Risk is higher where industrial reporting systems are reachable from broad corporate networks or older Internet Explorer/ActiveX workflows remain in use. Treat this as a legacy OT-facing exposure needing prompt inventory and containment. The main business concern is disruption of industrial information services, with possible code execution if vulnerable ActiveX paths remain usable. Priority depends on whether these versions still exist and who can reach them. Mitigation focus: Identify all Wonderware Information Server 3.1, 4.0, and 4.0 SP1 deployments.; Check vendor and US-CERT guidance for fixed versions or official mitigations.; Disable or restrict vulnerable ActiveX controls where operationally possible..

Prepared

Jun 27, 2026, 18:09 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.