PT-2017-16837 · Laquis · Laquis Scada

James Fitts · Published 2017-04-12 · Updated 2019-10-09 · CVE-2017-6020

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions LAquis SCADA software versions prior to 4.1.0.3237

Description The issue concerns a directory traversal information disclosure problem. It arises because the software does not properly neutralize external input, allowing users to potentially access absolute path sequences outside of their intended privilege level.

Recommendations For LAquis SCADA software versions prior to 4.1.0.3237, update to version 4.1.0.3237 or later to resolve the issue.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2017-6020

ZDI-17-286

Affected Products

Laquis Scada

References · 6

• 🔥 https://exploit-db.com/exploits/42885 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-6020 · Security Note
• https://osv.dev/vulnerability/CVE-2017-6020 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-17-286 · Security Note
• http://securityfocus.com/bid/97055 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-17-082-01 · Note