PT-2020-12240 · Opto 22 · Opto 22 Softpac Project

Published 2020-05-14 · Updated 2020-05-18 · CVE-2020-10612

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Opto 22 SoftPAC Project Version 9.6 and prior

Description The issue affects the communication between SoftPACAgent and SoftPACMonitor over network Port 22000, which is open without restrictions. This allows an attacker with network access to control the SoftPACAgent service, including updating SoftPAC firmware, starting or stopping the service, or writing to certain registry values.

Recommendations For Opto 22 SoftPAC Project Version 9.6 and prior, restrict access to network Port 22000 to prevent unauthorized control of the SoftPACAgent service. Consider implementing firewall rules or network access controls to limit access to this port. Additionally, monitor the SoftPACAgent service for any suspicious activity, such as unauthorized firmware updates or changes to registry values.

Fix

Improper Access Control

Missing Authorization

Weakness Enumeration

CWE-284

CWE-862

Related Identifiers

CVE-2020-10612

Affected Products

Opto 22 Softpac Project

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-10612 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10612 · Vendor Advisory
• https://us-cert.gov/ics/advisories/icsa-20-135-01 · Note