CVE-2022-43663
📋 TL;DR
An integer conversion vulnerability in WellinTech KingHistorian's SORBAx64.dll allows remote attackers to trigger a buffer overflow via specially crafted network packets. This could lead to arbitrary code execution or denial of service. Systems running vulnerable versions of KingHistorian with network exposure are affected.
💻 Affected Systems
- WellinTech KingHistorian
📦 What is this software?
Kinghistorian by Wellintech
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with SYSTEM/root privileges leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Denial of service causing KingHistorian service crashes and industrial process disruption.
If Mitigated
Limited impact with proper network segmentation and exploit prevention controls in place.
🎯 Exploit Status
Talos Intelligence published detailed analysis and proof-of-concept. The vulnerability requires sending crafted packets to the vulnerable service.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Contact WellinTech for updated version
Vendor Advisory: https://www.wellintech.com/security/ (check for specific advisory)
Restart Required: Yes
Instructions:
1. Contact WellinTech support for patched version
2. Backup KingHistorian configuration and data
3. Apply vendor-provided patch/update
4. Restart KingHistorian service
5. Verify functionality
🔧 Temporary Workarounds
Network Segmentation
windowsIsolate KingHistorian systems from untrusted networks using firewalls
Windows Firewall: New-NetFirewallRule -DisplayName "Block KingHistorian" -Direction Inbound -Protocol TCP -LocalPort [KingHistorian Port] -Action Block
Service Restriction
allRestrict KingHistorian service to only necessary IP addresses
🧯 If You Can't Patch
- Implement strict network access controls allowing only trusted systems to communicate with KingHistorian
- Deploy intrusion prevention systems (IPS) with rules to detect and block exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check KingHistorian version in About dialog or installation directory. Version 35.01.00.05 is confirmed vulnerable.Check Version:
Check KingHistorian GUI About section or examine installed program version in Windows Programs and FeaturesVerify Fix Applied:
Verify updated version from vendor and test network connectivity while monitoring for crashes.📡 Detection & Monitoring
Log Indicators:
- KingHistorian service crashes
- Unexpected process termination events
- Memory access violation errors in Windows Event Logs
Network Indicators:
- Unusual network traffic to KingHistorian ports
- Malformed packet patterns matching Talos PoC
SIEM Query:
source="windows" AND (event_id=1000 OR event_id=1001) AND process_name="KingHistorian*" OR source="firewall" AND dest_port=[KingHistorian Port] AND packet_size>normal