PT-2022-3462 · Open Automation · Open Automation Software Oas Platform

Jared Rittle · Published 2022-05-25 · Updated 2023-07-26 · CVE-2022-26303

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Open Automation Software OAS Platform version V16.00.0112

Description The issue concerns the OAS Engine SecureAddUser functionality, where a lack of authentication check for a critical function can be exploited. An attacker can send a specially-crafted series of network requests to create an OAS user account, potentially leading to unauthorized system access.

Recommendations For Open Automation Software OAS Platform version V16.00.0112, consider disabling the SecureAddUser functionality until a patch is available to prevent exploitation. Restrict access to the OAS Engine to minimize the risk of unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2022-04240

CVE-2022-26303

Affected Products

Open Automation Software Oas Platform

References · 5

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1488 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-26303 · Security Note
• https://safe-surf.ru/upload/VULN/VULN-20220526.7.pdf · Security Note
• https://bdu.fstec.ru/vul/2022-04240 · Security Note
• https://osv.dev/vulnerability/CVE-2022-26303 · Vendor Advisory