PT-2023-3650 · Unknown · Spidercontrol Scada Web Server
Yang Liu
·
Publicado
2023-06-22
·
Atualizado
2024-10-29
·
CVE-2023-3329
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
SpiderControl SCADA Webserver versions 2.08 and prior
Description
The issue exists due to incorrect restriction of the path name to a directory with limited access. Exploitation of this issue may allow a remote attacker to cause a denial-of-service condition. An attacker with administrative privileges could overwrite files on the webserver using the HMI's upload file feature, potentially creating size zero files anywhere on the webserver and overwriting system files.
Recommendations
For SpiderControl SCADA Webserver versions 2.08 and prior, consider restricting access to the upload file feature in the HMI until a patch is available. As a temporary workaround, limit the privileges of administrative users to minimize the risk of exploitation. Additionally, monitor the webserver for any suspicious activity, such as the creation of size zero files, to quickly identify potential security incidents.
Correção
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Spidercontrol Scada Web Server