CVE-2014-9203 json
Buffer overflow in the Field Device Tool (FDT) Frame application in the HART Device Type Manager (DTM) library, as used in MACTek Bullet DT…
published 2015-02-07 11 y ago modified 2026-06-17 4 mo ago also EUVD-2014-9028
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.8%
- EPSS 1.8% chance of exploitation in 30 days, percentile 78%
- public exploits
- 0
- none known
Summary
Buffer overflow in the Field Device Tool (FDT) Frame application in the HART Device Type Manager (DTM) library, as used in MACTek Bullet DTM 1.00.0, GE Vector DTM 1.00.0, GE SVi1000 Positioner DTM 1.00.0, GE SVI II AP Positioner DTM 2.00.1, and GE 12400 Level Transmitter DTM 1.00.0, allows remote attackers to cause a denial of service (DTM outage) via crafted packets.
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
cisa ICSA-15-036-01A updated cvss 6.8
GE and MACTek HART Device DTM Vulnerability (Update A)
-
GE’s 12400 Level Transmitter DTM 1.00.0 GE’s SVI II AP Positioner DTM 2.00.1 GE’s SVi1000 Positioner DTM 1.00.0 GE’s Vector DTM 1.00.0 GE MACTek’s Bullet DTM 1.00.0affected: mitigation “GE has released an advisory and update addressing the GE HART Device DTMs.”
From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf
Exploit prediction
1.80% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Classification
- Weakness
-
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
References
-
geoilandgas.com
/securityadvisory
vendor-advisory
-
ics-cert.us-cert.gov
/advisories/ICSA-15-036-01
third-party-advisory, us-government-resource
Sources
- CVE List CVE-2014-9203
- NVD CVE-2014-9203
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.