PT-2022-6659 · Measuresoft · Measuresoft Scadapro Server

Rgod777 · Published 2022-09-22 · Updated 2022-09-27 · CVE-2022-3263

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Measuresoft ScadaPro Server version 6.7

Description The issue is related to improper access control in the security descriptor of the SCADA server, which could allow a local user with limited privileges to modify the service binary path. This could enable an attacker to execute arbitrary commands with system privileges.

Recommendations For Measuresoft ScadaPro Server version 6.7, consider restricting access to the service binary path to prevent modification and limit the execution of malicious commands until a patch is available. As a temporary workaround, review and enforce strict access controls on the system to minimize the risk of exploitation.

Fix

Improper Access Control

Incorrect Default Permissions

Weakness Enumeration

CWE-284

CWE-276

Related Identifiers

BDU:2023-03153

CVE-2022-3263

ZDI-22-1301

Affected Products

Measuresoft Scadapro Server

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-3263 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-1301 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3263 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03153 · Security Note
• https://cisa.gov/news-events/ics-advisories/icsa-22-265-01 · Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-265-01 · Note
• https://vuldb.com/ru/?id.209516 · Note