CVE-2022-1261: Matrikon OPC Server Improper Access Control
First published: Thu May 26 2022(Updated: )
Matrikon, a subsidary of Honeywell Matrikon OPC Server (all versions) is vulnerable to a condition where a low privileged user allowed to connect to the OPC server to use the functions of the IPersisFile to execute operating system processes with system-level privileges.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Honeywell Matrikon OPC Server | ||
| Matrikon, a subsidiary of Honeywell Matrikon OPC Server |
Remedy
Matrikon advises affected users to apply mitigations from its security best practices document (login required).
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for Matrikon OPC Server?
The vulnerability ID for Matrikon OPC Server is CVE-2022-1261.
What is the severity of CVE-2022-1261?
The severity of CVE-2022-1261 is critical (8.8).
Which software versions of Matrikon OPC Server are affected?
All versions of Matrikon OPC Server are affected.
How can a low privileged user exploit CVE-2022-1261?
A low privileged user can exploit CVE-2022-1261 by connecting to the OPC server and using the functions of the IPersisFile to execute operating system processes with system-level privileges.
Is there a fix available for CVE-2022-1261?
The vendor has not provided a fix for CVE-2022-1261 yet. It is recommended to apply mitigations or follow the guidance provided by the vendor or cybersecurity authorities.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/title
- agent/remedy
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/severity
- agent/references
- agent/softwarecombine
- agent/event
- agent/tags
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/honeywell
- canonical/honeywell matrikon opc server
- vendor/matrikon, a subsidiary of honeywell
- canonical/matrikon, a subsidiary of honeywell matrikon opc server