PT-2020-13009

Name of the Vulnerable Software and Affected Versions Opto 22 SoftPAC Project versions 9.6 and prior Description The issue arises from unsanitized paths within zip files used for updating SoftPAC firmware, allowing an attacker with user privileges to gain arbitrary file write access with system...

CVE-2020-12042: Improper Verification of Cryptographic Signature

Opto 22 SoftPAC Project Version 9.6 and prior. Paths specified within the zip files used to update the SoftPAC firmware are not sanitized. As a result, an attacker with user privileges can gain arbitrary file write access with system access...

PT-2020-12248

Name of the Vulnerable Software and Affected Versions Opto 22 SoftPAC Project versions 9.6 and prior Description The issue allows an attacker with network access to directly communicate with SoftPAC, including stopping the service remotely, because SoftPAC communication does not include any...

PT-2020-12240

Name of the Vulnerable Software and Affected Versions Opto 22 SoftPAC Project Version 9.6 and prior Description The issue affects the communication between SoftPACAgent and SoftPACMonitor over network Port 22000, which is open without restrictions. This allows an attacker with network access to...

PT-2020-13012

Name of the Vulnerable Software and Affected Versions Opto 22 SoftPAC Project versions 9.6 and prior Description The issue concerns the lack of verification of firmware files' signatures during updates, allowing an attacker to replace legitimate firmware files with malicious ones. Recommendations...

PT-2020-12244

Name of the Vulnerable Software and Affected Versions Opto 22 SoftPAC Project versions 9.6 and prior Description The issue arises because SoftPAC does not specify the path of multiple imported .dll files, allowing an attacker to replace them and execute code whenever the service starts...

CVE-2020-10620: Improper Authorization

Opto 22 SoftPAC Project Version 9.6 and prior. SoftPAC communication does not include any credentials. This allows an attacker with network access to directly communicate with SoftPAC, including, for example, stopping the service remotely...

CVE-2020-10612: Improper Access Control

Opto 22 SoftPAC Project Version 9.6 and prior. SoftPACAgent communicates with SoftPACMonitor over network Port 22000. However, this port is open without any restrictions. This allows an attacker with network access to control the SoftPACAgent service including updating SoftPAC firmware, starting ...

CVE-2020-10616: Uncontrolled Search Path Element

Opto 22 SoftPAC Project Version 9.6 and prior. SoftPAC does not specify the path of multiple imported .dll files. Therefore, an attacker can replace them and execute code whenever the service starts...

Opto 22 SoftPAC Project

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Opto 22 Equipment: SoftPAC Project Vulnerabilities: External Control of File Name or Path, Improper Verification of Cryptographic Signature, Improper Access Control, Uncontrolled Search Path...