AVEVA InTouch Access Anywhere - Panel Detection

Detected AVEVA InTouch Access Anywhere was a secure gateway that provided browser-based remote access to InTouch HMI applications over the internet. It was widely used in industrial process control, utilities, and manufacturing environments. Exposed instances may have provided access to industria...

AVEVA InTouch Access Anywhere Secure Gateway - Local File Inclusion Detection

AVEVA InTouch Access Anywhere Secure Gateway is vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """AVEVA InTouch Access Anywhere Secure Gateway is vulnerable to local file inclusion.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...

EUVD-2018-2700

Malware in sbrugna...

EUVD-2021-19663

Malware in sbrugna...

CVE-2022-23854

CVE-2022-23854 affects AVEVA InTouch Access Anywhere Secure Gateway (2020 R2 and earlier). The vulnerability is a path traversal issue allowing an unauthenticated remote attacker with network access to read files outside the secure gateway web server (local file inclusion/vector). Affected produc...

CVE-2022-23854

AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated user with network access to read files on the system outside of the secure gateway web server...

CVE-2022-23854

AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated user with network access to read files on the system outside of the secure gateway web server...

PT-2022-6508 · Aveva · Aveva Intouch Access Anywhere

Name of the Vulnerable Software and Affected Versions: AVEVA InTouch Access Anywhere versions 2020 R2 and older Description: The issue is related to errors in processing relative path to directory, which could allow an unauthenticated user with network access to read files on the system outside o...

CVE-2022-23854: Relative Path Traversal

AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated user with network access to read files on the system outside of the secure gateway web server...

CISA Releases Three Industrial Control Advisories

CISA has released three 3 Industrial Control Systems ICS advisories on 08 December 2022. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. CISA encourages users and administrators to review the newly released ICS advisories f...

AVEVA InTouch Access Anywhere Secure Gateway 2020 R2 - Path Traversal Vulnerability

Exploit Title: AVEVA InTouch Access Anywhere Secure Gateway 2020 R2 - Path Traversal Exploit Author: Jens Regel CRISEC IT-Security CVE: CVE-2022-23854 Version: Access Anywhere Secure Gateway versions 2020 R2 and older Proof of Concept: GET...

AVEVA InTouch Access Anywhere Secure Gateway 2020 R2 Path Traversal

Exploit Title: AVEVA InTouch Access Anywhere Secure Gateway 2020 R2 - Path Traversal Exploit Author: Jens Regel CRISEC IT-Security Date: 11/11/2022 CVE: CVE-2022-23854 Version: Access Anywhere Secure Gateway versions 2020 R2 and older Proof of Concept: GET...

AVEVA InTouch Access Anywhere Secure Gateway 2020 R2 - Path Traversal

Exploit Title: AVEVA InTouch Access Anywhere Secure Gateway 2020 R2 - Path Traversal Exploit Author: Jens Regel CRISEC IT-Security Date: 11/11/2022 CVE: CVE-2022-23854 Version: Access Anywhere Secure Gateway versions 2020 R2 and older Proof of Concept: GET...

AVEVA InTouch Access Anywhere Secure Gateway: Path traversal vulnerability

AVEVA InTouch Access Anywhere Secure Gateway is an InTouch extension from AVEVA Software UK. It provides mobile and occasional users with the ability to access InTouch applications through HTML5 compatible browsers. A path traversal vulnerability exists in AVEVA InTouch Access Anywhere Secure...

CVE-2022-1467

Windows OS can be configured to overlay a “language bar” on top of any application. When this OS functionality is enabled, the OS language bar UI will be viewable in the browser alongside the AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere applications. It is possible to manipulate...

Command injection

Windows OS can be configured to overlay a “language bar” on top of any application. When this OS functionality is enabled, the OS language bar UI will be viewable in the browser alongside the AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere applications. It is possible to manipulate...

CVE-2022-1467 AVEVA InTouch Access Anywhere Exposure of Resource to Wrong Sphere

Windows OS can be configured to overlay a “language bar” on top of any application. When this OS functionality is enabled, the OS language bar UI will be viewable in the browser alongside the AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere applications. It is possible to manipulate...

CVE-2022-1467 AVEVA InTouch Access Anywhere Exposure of Resource to Wrong Sphere

Windows OS can be configured to overlay a “language bar” on top of any application. When this OS functionality is enabled, the OS language bar UI will be viewable in the browser alongside the AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere applications. It is possible to manipulate...

CVE-2022-1467

CVE-2022-1467 affects AVEVA InTouch Access Anywhere and AVEVA Plant SCADA Access Anywhere (all versions). The root cause is a Windows language bar overlay that can be manipulated to launch an OS command prompt from within the browser, creating a context-escape from the hosted application to the O...

CVE-2022-1467: Exposure of Resource to Wrong Sphere

Windows OS can be configured to overlay a “language bar” on top of any application. When this OS functionality is enabled, the OS language bar UI will be viewable in the browser alongside the AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere applications. It is possible to manipulate...