AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere
This updated advisory is a follow-up to the original advisory titled ICSA-22-342-02 AVEVA InTouch Access Anywhere, published December 8, 2022 on the ICS webpage at cisa.gov/topics/industrial-control-systems.
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-23854US | high7.5 | Exploit | ||
AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated user with network access to read files on th… | ||||
| CVE-2021-3711US | critical9.8 | — | ||
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first tim… | ||||
| CVE-2020-11022US | medium6.1 | Exploit | ||
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append… | ||||
references
External citations — patches, advisories, analysis.
remediations (6)
- MitigationInTouch Access Anywhere
InTouch Access Anywhere Secure Gateway 2020 R2 (version 20.1.0) Hotfix.
- MitigationInTouch Access Anywhere
InTouch Access Anywhere Secure Gateway 2020 R2 (version 20.1.0) Hotfix.
- MitigationInTouch Access Anywhere
InTouch Access Anywhere Secure Gateway 2020 R2 (version 20.1.0) Hotfix.
- MitigationPlant SCADA Access Anywhere
InTouch Access Anywhere Secure Gateway 2020 R2 (version 20.1.0) Hotfix.
- MitigationPlant SCADA Access Anywhere
InTouch Access Anywhere Secure Gateway 2020 R2 (version 20.1.0) Hotfix.
- MitigationPlant SCADA Access Anywhere
InTouch Access Anywhere Secure Gateway 2020 R2 (version 20.1.0) Hotfix.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan