CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-44725
https://notcve.org/view.php?id=CVE-2022-44725
OPC Foundation Local Discovery Server (LDS) through 1.04.403.478 uses a hard-coded file path to a configuration file. This allows a normal user to create a malicious file that is loaded by LDS (running as a high-privilege user). OPC Foundation Local Discovery Server (LDS) hasta 1.04.403.478 utiliza una ruta de archivo codificada para un archivo de configuración. Esto permite a un usuario normal crear un archivo malicioso que LDS carga (ejecutándose como un usuario con altos privilegios). • https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2022-44725.pdf https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-11672
https://notcve.org/view.php?id=CVE-2017-11672
The OPC Foundation Local Discovery Server (LDS) before 1.03.367 is installed as a Windows Service without adding double quotes around the opcualds.exe executable path, which might allow local users to gain privileges. OPC Foundation Local Discovery Server (LDS) en versiones anteriores a la 1.03.367 está instalado como servicio de Windows sin añadir comillas dobles alrededor de la ruta ejecutable de opcualds.exe, lo que podría permitir que los usuarios locales obtengan privilegios. • https://opcfoundation-onlineapplications.org/faq/SecurityBulletins/OPC_Foundation_Security_Bulletin_CVE-2017-11672.pdf • CWE-428: Unquoted Search Path or Element •
CVSS: 8.2EPSS: 0%CPEs: 4EXPL: 0CVE-2017-12069
https://notcve.org/view.php?id=CVE-2017-12069
An XXE vulnerability has been identified in OPC Foundation UA .NET Sample Code before 2017-03-21 and Local Discovery Server (LDS) before 1.03.367. Among the affected products are Siemens SIMATIC PCS7 (All versions V8.1 and earlier), SIMATIC WinCC (All versions < V7.4 SP1), SIMATIC WinCC Runtime Professional (All versions < V14 SP1), SIMATIC NET PC Software, and SIMATIC IT Production Suite. By sending specially crafted packets to the OPC Discovery Server at port 4840/tcp, an attacker might cause the system to access various resources chosen by the attacker. Se ha identificado una vulnerabilidad XXE en OPC Foundation UA .NET Sample Code antes del 21-03-2017 y Local Discovery Server (LDS) antes de la versión 1.03.367. Los siguientes productos se han visto afectados por esta vulnerabilidad, entre otros: Siemens SIMATIC PCS7 (todas las versiones V8.1 y anteriores), SIMATIC WinCC (todas las versiones anteriores a V7.4 SP1), SIMATIC WinCC Runtime Professional (todas las versiones anteriores a V14 SP1), SIMATIC NET PC Software y SIMATIC IT Production Suite. • http://www.securityfocus.com/bid/100559 http://www.securitytracker.com/id/1039510 https://opcfoundation-onlineapplications.org/faq/SecurityBulletins/OPC_Foundation_Security_Bulletin_CVE-2017-12069.pdf https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-535640.pdf • CWE-611: Improper Restriction of XML External Entity Reference •