PT-2023-9498 · Unknown · Laquis Scada

Natnael Samson · Published 2023-11-15 · Updated 2024-05-22 · CVE-2024-5040

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LAquis SCADA (affected versions not specified)

Description The issue is related to the LAquis SCADA system, where an attacker can access locations outside of their own directory. This is due to incorrect restriction of the path name to a directory with limited access. Exploitation of this issue may allow an attacker to read, modify, or delete data, or execute arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2024-07897

CVE-2024-5040

ZDI-24-484

ZDI-24-485

ZDI-24-486

ZDI-24-487

ZDI-24-488

ZDI-24-489

ZDI-24-490

Affected Products

Laquis Scada

References · 15

• https://zerodayinitiative.com/advisories/ZDI-24-485 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-486 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-487 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-5040 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-488 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-489 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-484 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-490 · Security Note
• https://bdu.fstec.ru/vul/2024-07897 · Security Note
• https://twitter.com/CVEnew/status/1793384266702680212 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-24-142-01 · Note
• https://twitter.com/VulmonFeeds/status/1792999290547167564 · Twitter Post
• https://t.me/cvenotify/80620 · Telegram Post
• https://twitter.com/cracbot/status/1793522379894964310 · Twitter Post
• https://t.me/cvenotify/80689 · Telegram Post