CVE-2017-6020

🗓️ 17 Apr 2018 14:00:00Reported by icscertType

cve🔗 web.nvd.nist.gov👁 72 Views🌐 WEB

Leao Consultoria e Desenvolvimento de Sistemas (LCDS) LTDA ME LAquis SCADA software versions prior to version 4.1.0.3237 do not neutralize external input to ensure that users are not calling for absolute path sequences outside of their privilege level

Reporter	Title	Published	Views	Family All 11
0day.today	LAquis SCADA 4.1.0.2385 - Directory Traversal Exploit	28 Sep 201700:00	–	zdt
Cvelist	CVE-2017-6020	17 Apr 201814:00	–	cvelist
Exploit DB	LAquis SCADA 4.1.0.2385 - Directory Traversal (Metasploit)	27 Sep 201700:00	–	exploitdb
EUVD	EUVD-2017-15088	7 Oct 202500:30	–	euvd
exploitpack	LAquis SCADA 4.1.0.2385 - Directory Traversal (Metasploit)	27 Sep 201700:00	–	exploitpack
ICS	LCDS - Leão Consultoria e Desenvolvimento de Sistemas Ltda ME LAquis SCADA	23 Mar 201700:00	–	ics
NVD	CVE-2017-6020	17 Apr 201814:29	–	nvd
OSV	CVE-2017-6020	17 Apr 201814:29	–	osv
Packet Storm	LAquis SCADA 4.1.0.2385 Directory Traversal	29 Sep 201700:00	–	packetstorm
Prion	Design/Logic Flaw	17 Apr 201814:29	–	prion

NVD

Vulners

Node

lcds laquis_scadaRange<4.1.0.3237

[
  {
    "product": "LAquis SCADA software",
    "vendor": "LCDS - LeÃ£o Consultoria e Desenvolvimento de Sistemas LTDA ME",
    "versions": [
      {
        "status": "affected",
        "version": "versions prior to version 4.1.0.3237"
      }
    ]
  }
]

Source	Link
exploit-db	www.exploit-db.com/exploits/42885/
securityfocus	www.securityfocus.com/bid/97055
ics-cert	www.ics-cert.us-cert.gov/advisories/ICSA-17-082-01

Parameter	Position	Path	Description	CWE
NOME	query param	listagem.laquis	Directory traversal leading to information disclosure via vulnerable NOME parameter on listagem.laquis	CWE-22

17 Jun 2026 01:21Current

5.3Medium risk

Vulners AI Score5.3

CVSS 24

CVSS 35.3

EPSS0.08733

CWE-22