Design/Logic Flaw

2022-04-0123:15:00

PRIOn knowledge base

www.prio-n.com

8.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.3%

JSON

A getfile function in MDT AutoSave versions prior to v6.02.06 enables a user to supply an optional parameter, resulting in the processing of a request in a special manner. This can result in the execution of an unzip command and place a malicious .exe file in one of the locations the function looks for and get execution capabilities.

CPENameOperatorVersion
autosavelt6.02.06
autosavege7.00
autosavele7.04
autosave_for_system_platformlt4.01
autosave_for_system_platformeq5.00

Name	Operator	Version
autosave	lt	6.02.06
autosave	ge	7.00
autosave	le	7.04
autosave_for_system_platform	lt	4.01
autosave_for_system_platform	eq	5.00

References

www.cisa.gov/uscert/ics/advisories/icsa-21-189-02