PT-2023-3650 · Unknown · Spidercontrol Scada Web Server

Yang Liu · Published 2023-06-22 · Updated 2024-10-29 · CVE-2023-3329

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions SpiderControl SCADA Webserver versions 2.08 and prior

Description The issue exists due to incorrect restriction of the path name to a directory with limited access. Exploitation of this issue may allow a remote attacker to cause a denial-of-service condition. An attacker with administrative privileges could overwrite files on the webserver using the HMI's upload file feature, potentially creating size zero files anywhere on the webserver and overwriting system files.

Recommendations For SpiderControl SCADA Webserver versions 2.08 and prior, consider restricting access to the upload file feature in the HMI until a patch is available. As a temporary workaround, limit the privileges of administrative users to minimize the risk of exploitation. Additionally, monitor the webserver for any suspicious activity, such as the creation of size zero files, to quickly identify potential security incidents.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2023-03934

CVE-2023-3329

Affected Products

Spidercontrol Scada Web Server

References · 8

• https://bdu.fstec.ru/vul/2023-03934 · Security Note
• https://osv.dev/vulnerability/CVE-2023-3329 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3329 · Security Note
• https://vuldb.com/ru/?id.232178 · Note
• https://t.me/cibsecurity/67625 · Telegram Post
• https://t.me/cvenotify/56020 · Telegram Post
• https://t.me/cvenotify/99918 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-173-03 · Note