PT-2023-5840 · Triangle Microworks · Triangle Microworks Scada Data Gateway

Published 2023-02-24 · Updated 2024-05-05 · CVE-2023-39458

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Triangle MicroWorks SCADA Data Gateway (affected versions not specified)

Description This issue allows network-adjacent attackers to bypass authentication on affected installations of Triangle MicroWorks SCADA Data Gateway. The specific flaw exists within the handling of certificates, where the service uses a hard-coded default SSL certificate. An attacker can leverage this vulnerability to bypass authentication on the system. The vulnerability is related to the use of hard-coded credentials in the SCADA system, which can allow a remote attacker to gain unauthorized access to protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2023-06526

CVE-2023-39458

ZDI-23-1026

Affected Products

Triangle Microworks Scada Data Gateway

References · 9

• https://trianglemicroworks.com/products/scada-data-gateway/what\'s-new · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-39458 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06526 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-39458 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-1026 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-CAN-20509 · Note
• https://trianglemicroworks.com/products/scada-data-gateway/what's-new · Note
• https://cybersecurity-help.cz/vdb/SB2023080726 · Note
• https://twitter.com/CVEnew/status/1787185212478423232 · Twitter Post