PT-2022-2740 · Open Automation · Open Automation Software Oas Platform

Jared Rittle · Published 2022-05-25 · Updated 2024-02-15 · CVE-2022-26833

Positive Technologies (AI Summary)

CVSS v3.1

9.7

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions Open Automation Software OAS Platform version 16.00.0121

Description The issue is related to an improper authentication vulnerability in the REST API functionality. This vulnerability can be triggered by a specially-crafted series of HTTP requests, leading to unauthenticated use of the REST API. An attacker can exploit this by sending a series of HTTP requests, potentially allowing remote execution of arbitrary code.

Recommendations For Open Automation Software OAS Platform version 16.00.0121, consider disabling the REST API functionality until a patch is available to prevent unauthenticated use. Restrict access to the REST API to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2022-03246

CVE-2022-26833

Affected Products

Open Automation Software Oas Platform

References · 7

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1513 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-26833 · Security Note
• https://bdu.fstec.ru/vul/2022-03246 · Security Note
• https://osv.dev/vulnerability/CVE-2022-26833 · Vendor Advisory
• https://t.me/true_secator/2985 · Telegram Post
• https://threatpost.com/critical-flaws-in-popular-ics-platform-can-trigger-rce/179750 · Note
• https://t.me/cvenotify/31043 · Telegram Post