what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

LAquis SCADA 4.1 Access Control

LAquis SCADA 4.1 Access Control
Posted Apr 6, 2017
Authored by Karn Ganeshen

LAquis SCADA version 4.1 suffers from access control issues.

tags | advisory, bypass
advisories | CVE-2017-6016
SHA-256 | 86fbbd5516820667a46d0ba5ad09fd19f5f20c2b0184e3600ed71fd84482b636

LAquis SCADA 4.1 Access Control

Change Mirror Download
LCDS a LeAPSo Consultoria e Desenvolvimento de Sistemas LTDA ME LAquis SCADA
Access Control Vulnerability

Vendor: LCDS a LeAPSo Consultoria e Desenvolvimento de Sistemas LTDA ME
Equipment: LAquis SCADA
Vulnerability: Improper Access Control

ICS-CERT Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-17-075-01

AFFECTED PRODUCTS

The following versions of LAquis SCADA, an industrial automation software,
are affected:
LAquis SCADA software, Versions 4.1 and prior versions released before
January 20, 2017.

IMPACT
Successful exploitation of this vulnerability could allow authenticated
system users to escalate their privileges and modify or replace application
files.

IMPROPER ACCESS CONTROL CWE-284
An Improper Access Control vulnerability has been identified, which may
allow an authenticated user to modify application files to escalate
privileges.

CVE-2017-6016 has been assigned to this vulnerability. A CVSS v3 base score
of 7.3 has been assigned; the CVSS vector string is
(AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).

VULNERABILITY OVERVIEW

SCADA LAquis software is vulnerable to local privilege escalation. EVERYONE
has FULL permissions over all the install files (*exe,*dll), therefore, it
is possible for any local, authenticated, non-admin user to replace/modify
original application files with malicious ones, and gain higher privileged
access once an administrative user runs the application. Other vectors are
possible as well.

+++++


Login or Register to add favorites

File Archive:

June 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    0 Files
  • 2
    Jun 2nd
    0 Files
  • 3
    Jun 3rd
    18 Files
  • 4
    Jun 4th
    21 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    57 Files
  • 7
    Jun 7th
    6 Files
  • 8
    Jun 8th
    0 Files
  • 9
    Jun 9th
    0 Files
  • 10
    Jun 10th
    12 Files
  • 11
    Jun 11th
    27 Files
  • 12
    Jun 12th
    38 Files
  • 13
    Jun 13th
    16 Files
  • 14
    Jun 14th
    14 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    0 Files
  • 20
    Jun 20th
    0 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close