Mr Me

**Name of the Vulnerable Software and Affected Versions** LCDS Laquis SCADA versions prior to 4.1.0.4150 **Description** The issue allows the opening of a specially crafted report format file, which may cause an out of bounds read. This can lead to a system crash, allow data exfiltration, or enable remote code execution. **Recommendations** For versions prior to 4.1.0.4150, update to version 4.1.0.4150 or later to resolve the issue. As a temporary workaround, consider restricting the opening of report format files from untrusted sources until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** LCDS Laquis SCADA versions prior to 4.1.0.4150 **Description** The issue allows execution of script code by opening a specially crafted report format file, which may lead to remote code execution, data exfiltration, or cause a system crash. Multiple vulnerabilities have been identified in the LAquis SCADA LGX Report, including path traversal, information disclosure, remote code execution, and arbitrary file creation. **Recommendations** For versions prior to 4.1.0.4150, update to version 4.1.0.4150 or later to resolve the issue. As a temporary workaround, consider restricting the opening of report format files from untrusted sources until a patch is available. Avoid using the LGX Report feature until the issue is resolved. Restrict access to the LGX Report module to minimize the risk of exploitation. Consider disabling the `ShellExecute` function and other vulnerable functions until a patch is available. At the moment, there is no other information about additional mitigation measures for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LCDS Laquis SCADA versions prior to 4.1.0.4150 **Description** The issue allows a user-supplied path in file operations prior to proper validation, which can be leveraged by an attacker to disclose sensitive information under the context of the web server process. **Recommendations** For versions prior to 4.1.0.4150, update to version 4.1.0.4150 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** LCDS Laquis SCADA versions prior to 4.1.0.4150 **Description** The issue allows an attacker to execute remote code on the server due to improper sanitation of user input. This can be achieved through command injection vulnerabilities in various components of the LAquis SCADA Web Server, including the relatorioindividual TAG, acompanhamentotela TAGALTERE, acompanhamentotela PAGINA, and relatorioindividual TITULO. **Recommendations** For versions prior to 4.1.0.4150, update to version 4.1.0.4150 or later to resolve the issue. As a temporary workaround, consider restricting access to the LAquis SCADA Web Server to minimize the risk of exploitation. Avoid using user input in the affected components until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** LCDS Laquis SCADA versions prior to 4.1.0.4150 **Description** The issue allows for an out of bounds read when opening a specially crafted project file. This may cause a system crash or allow data exfiltration. **Recommendations** For versions prior to 4.1.0.4150, update to version 4.1.0.4150 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** LCDS Laquis SCADA versions prior to 4.1.0.4150 **Description** The issue allows an attacker to execute remote code on the server due to improper authorization or sanitation of user input. This can be achieved through command injection in certain parameters, such as `relatorionome TAG`, `relatorionome TITULO`, and `relatorionome NOME`. **Recommendations** For versions prior to 4.1.0.4150, update to version 4.1.0.4150 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected parameters `relatorionome TAG`, `relatorionome TITULO`, and `relatorionome NOME` to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** LCDS Laquis SCADA versions prior to 4.1.0.4150 **Description** The issue allows an attacker to gain unauthorized access to the system with high privileges due to the use of hard-coded credentials. **Recommendations** For versions prior to 4.1.0.4150, update to version 4.1.0.4150 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** LCDS Laquis SCADA versions prior to 4.1.0.4150 **Description** The issue allows an authentication bypass, which may enable an attacker to access sensitive data. **Recommendations** For versions prior to 4.1.0.4150, update to version 4.1.0.4150 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** LCDS Laquis SCADA versions prior to 4.1.0.4150 **Description** The issue allows an attacker to supply a pointer for a controlled memory address using a specially crafted project file. This may lead to remote code execution, data exfiltration, or cause a system crash. **Recommendations** For versions prior to 4.1.0.4150, update to version 4.1.0.4150 or later to resolve the issue.