PT-2017-3120 · Spidercontrol · Spidercontrol Scada Web Server

Publicado 2017-09-07 · Atualizado 2020-08-19 · CVE-2017-12728

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SpiderControl SCADA Web Server versions 2.02.0007 and prior

Description An issue with improper privilege management was found, allowing authenticated, non-administrative local users to modify service executables with elevated privileges. This could enable an attacker to execute arbitrary code in the context of the current system services.

Recommendations For SpiderControl SCADA Web Server versions 2.02.0007 and prior, consider restricting access to service executables to prevent modification with escalated privileges until a patch is available. As a temporary workaround, limit the privileges of non-administrative local users to minimize the risk of exploitation.

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-264

CWE-269

Identificadores relacionados

BDU:2017-02520

CVE-2017-12728

Produtos afetados

Spidercontrol Scada Web Server

Referências · 5

• https://ics-cert.us-cert.gov/advisories/ICSA-17-250-01 · Nota
• https://bdu.fstec.ru/vul/2017-02520 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-12728 · Aviso do Fabricante
• http://securityfocus.com/bid/100668 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-12728 · Nota de Segurança