PT-2023-4120 · Unknown · Ao-Opc Server

CVE-2023-2685 · Publicado 2023-07-14 · Atualizado 2023-08-04

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AO-OPC server versions prior to 3.2.1

Description A vulnerability was found in the AO-OPC server where the directory information for the service entry is not enclosed in quotation marks. This could allow potential attackers to call up another application than the AO-OPC server by starting the service, possibly with system user privileges, which could cause a shift in user access privileges. It is unlikely to exploit this issue in well-maintained Windows installations since the attacker would need write access to system folders.

Recommendations For AO-OPC server versions prior to 3.2.1, update to version 3.2.1 to resolve the vulnerability. As a temporary workaround, consider restricting access to the service entry to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-428

Identificadores relacionados

BDU:2023-04429

CVE-2023-2685

Produtos afetados

Ao-Opc Server

Referências · 6

• https://search.abb.com/library/Download.aspx?DocumentID=9AKK108468A4093&LanguageCode=en&DocumentPartId=&Action=Launch · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-2685 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-04429 · Nota de Segurança
• https://t.me/cvenotify/55420 · Publicação no Telegram
• https://search.abb.com/library/Download.aspx?DocumentID=9AKK108468A4093&LanguageCode=en&DocumentPartId=&Action=Launch · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-2685 · Nota de Segurança