PT-2022-3170 · Unknown · Pacsystems

Published 2022-06-22 · Updated 2022-06-22 · CVE-2022-30265

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PACsystems (affected versions not specified)

Description The issue is related to insufficient data authentication in the PACsystems programmable logic controller software. It allows a remote attacker to execute arbitrary code using a specially crafted file written in C or IEC 61131-3 programming languages.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

BDU:2022-03850

CVE-2022-30265

Affected Products

Pacsystems

References · 3

• https://bdu.fstec.ru/vul/2022-03850 · Security Note
• https://forescout.com/resources/ot-icefall-report · Note
• https://csirt.gob.cl/media/2022/06/9VSA22-00666-01-1.pdf · Note