Lucene search

IcscertCVELIST:CVE-2022-3263

HistorySep 22, 2022 - 12:00 a.m.

CVE-2022-3263 Measuresoft ScadaPro Server Improper Access Control

2022-09-2200:00:00

CWE-284

icscert

www.cve.org

measuresoft scadapro

improper access control

version 6.7

cve-2022-3263

local user

limited privileges

inconsistent permissions

service binary path

system privileges

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

16.2%

JSON

The security descriptor of Measuresoft ScadaPro Server version 6.7 has inconsistent permissions, which could allow a local user with limited privileges to modify the service binary path and start malicious commands with SYSTEM privileges.

CNA Affected

[
  {
    "product": "ScadaPro Server",
    "vendor": "Measuresoft ",
    "versions": [
      {
        "status": "affected",
        "version": "6.7"
      }
    ]
  }
]

References

www.cisa.gov/uscert/ics/advisories/icsa-22-265-01

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

16.2%

JSON

Related for CVELIST:CVE-2022-3263