CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-3746 – Measuresoft ScadaPro Improper Access Control
https://notcve.org/view.php?id=CVE-2024-3746
The entire parent directory - C:\ScadaPro and its sub-directories and files are configured by default to allow user, including unprivileged users, to write or overwrite files. Todo el directorio principal, C:\ScadaPro y sus subdirectorios y archivos, están configurados de forma predeterminada para permitir a los usuarios, incluidos los usuarios sin privilegios, escribir o sobrescribir archivos. • https://www.cisa.gov/news-events/ics-advisories/icsa-24-107-01 • CWE-284: Improper Access Control •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-3263 – Measuresoft ScadaPro Server Improper Access Control
https://notcve.org/view.php?id=CVE-2022-3263
The security descriptor of Measuresoft ScadaPro Server version 6.7 has inconsistent permissions, which could allow a local user with limited privileges to modify the service binary path and start malicious commands with SYSTEM privileges. El descriptor de seguridad de Measuresoft ScadaPro Server versión 6.7, presenta permisos inconsistentes, lo que podría permitir a un usuario local privilegiado limitado modificar la ruta binaria del servicio e iniciar comandos maliciosos con privilegios SYSTEM. This vulnerability allows local attackers to escalate privileges on affected installations of Measuresoft ScadaPro Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the ORCHESTRATOR Service. The product sets incorrect permissions on the service. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-265-01 • CWE-276: Incorrect Default Permissions CWE-284: Improper Access Control •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-2894 – Measuresoft ScadaPro Server Untrusted Pointer Dereference
https://notcve.org/view.php?id=CVE-2022-2894
Measuresoft ScadaPro Server (All Versions) uses unmaintained ActiveX controls. The controls may allow seven untrusted pointer deference instances while processing a specific project file. Measuresoft ScadaPro Server (Todas las versiones) usa controles ActiveX sin mantenimiento. Los controles pueden permitir siete instancias de deferencia de puntero no confiable mientras es procesado un archivo de proyecto específico This vulnerability allows remote attackers to execute arbitrary code on affected installations of Measuresoft ScadaPro Server. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ORM files. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-06 • CWE-822: Untrusted Pointer Dereference •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-2892 – Measuresoft ScadaPro Server Out-of-bounds Write
https://notcve.org/view.php?id=CVE-2022-2892
Measuresoft ScadaPro Server (Versions prior to 6.8.0.1) uses an unmaintained ActiveX control, which may allow an out-of-bounds write condition while processing a specific project file. Measuresoft ScadaPro Server (Versiones anteriores a 6.8.0.1) usa un control ActiveX no mantenido, que puede permitir una condición de escritura fuera de límites mientras es procesado un archivo de proyecto específico This vulnerability allows remote attackers to execute arbitrary code on affected installations of Measuresoft ScadaPro Server. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ORM files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-05 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-2897 – Measuresoft ScadaPro Server and Client Link Following
https://notcve.org/view.php?id=CVE-2022-2897
Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow privilege escalation.. Measuresoft ScadaPro Server y Client (Todas las versiones) no resuelven apropiadamente los enlaces antes de acceder a archivos; esto podría permitir una escalada de privilegios.. This vulnerability allows local attackers to escalate privileges on affected installations of Measuresoft ScadaPro Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the ScadaPro Server installer. By creating a symbolic link, an attacker can abuse the installer to overwrite a file. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-06 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •