PT-2023-4120 · Unknown · Ao-Opc Server

Published 2023-07-14 · Updated 2023-08-04 · CVE-2023-2685

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AO-OPC server versions prior to 3.2.1

Description A vulnerability was found in the AO-OPC server where the directory information for the service entry is not enclosed in quotation marks. This could allow potential attackers to call up another application than the AO-OPC server by starting the service, possibly with system user privileges, which could cause a shift in user access privileges. It is unlikely to exploit this issue in well-maintained Windows installations since the attacker would need write access to system folders.

Recommendations For AO-OPC server versions prior to 3.2.1, update to version 3.2.1 to resolve the vulnerability. As a temporary workaround, consider restricting access to the service entry to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-428

Related Identifiers

BDU:2023-04429

CVE-2023-2685

Affected Products

Ao-Opc Server

References · 6

• https://search.abb.com/library/Download.aspx?DocumentID=9AKK108468A4093&LanguageCode=en&DocumentPartId=&Action=Launch · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-2685 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04429 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-2685 · Security Note
• https://t.me/cvenotify/55420 · Telegram Post
• https://search.abb.com/library/Download.aspx?DocumentID=9AKK108468A4093&LanguageCode=en&DocumentPartId=&Action=Launch · Note