ICSA-22-130-05

icsaUScisa_csaf_ot

AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere

Advisory ansehen veröffentlicht 2022-05-10

Successful exploitation of this vulnerability could allow an authenticated user to escape from the context of the streamed application into the OS and launch arbitrary OS commands.

01

beschreibt (1)

Zugehörige CVEs.

IDSchweregrad ausnutzbar
CVE-2022-1467UScritical9.9—
Windows OS can be configured to overlay a “language bar” on top of any application. When this OS functionality is enabled, the OS language bar UI will be viewable in the browser al…
02

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

03

Behebungen (2)

  • MitigationAVEVA InTouch Access Anywhere

    Create unique user accounts with minimal privileges dedicated only to remote access of InTouch Access Anywhere and Plant SCADA Access Anywhere applications.

  • MitigationAVEVA Plant SCADA Access Anywhere (formerly known as AVEVA Citect Anywhere and Schneider Electric Citect Anywhere)

    Create unique user accounts with minimal privileges dedicated only to remote access of InTouch Access Anywhere and Plant SCADA Access Anywhere applications.

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan