PT-2018-16890 · Rapid Scada · Rapid Scada

Filipe Xavier Oliveira · Publicado 2018-03-08 · Atualizado 2020-08-24 · CVE-2018-5313

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rapid Scada version 5.5.0

Description A local attacker can escalate privileges due to weak access control restrictions set during the installation of the product. The vulnerability exists within the access control and allows an attacker to execute arbitrary code under the context of Administrator, the IUSR account, or SYSTEM.

Recommendations For Rapid Scada version 5.5.0, consider restricting access to the C:SCADA directory to prevent exploitation until a patch is available. As a temporary workaround, review and modify the access control settings to enforce stronger permissions, limiting the ability of attackers to leverage this flaw for privilege escalation.

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2018-5313

Produtos afetados

Rapid Scada

Referências · 4

• http://seclists.org/fulldisclosure/2018/Mar/11 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-5313 · Nota de Segurança
• http://packetstormsecurity.com/files/146668/Rapid-Scada-5.5.0-Insecure-Permissions.html · Nota
• https://osv.dev/vulnerability/CVE-2018-5313 · Aviso do Fabricante