CVE-2023-39457: (Pwn2Own) Triangle MicroWorks SCADA Data Gateway Missing Authentication Vulnerability
This vulnerability allows remote attackers to bypass authentication on affected installations of Triangle MicroWorks SCADA Data Gateway. Authentication is not required to exploit this vulnerability. The specific flaw exists due to the lack of user authentication. The issue results from missing authentication in the default system configuration. An attacker can leverage this vulnerability to execute arbitrary code in the context of root.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-39457?
CVE-2023-39457 has been classified as critical due to its ability to allow remote attackers to bypass authentication.
How do I fix CVE-2023-39457?
To mitigate CVE-2023-39457, update the Triangle MicroWorks SCADA Data Gateway to the latest version that includes authentication patches.
What systems are affected by CVE-2023-39457?
CVE-2023-39457 affects installations of the Triangle MicroWorks SCADA Data Gateway that do not implement proper user authentication.
Can CVE-2023-39457 be exploited remotely?
Yes, CVE-2023-39457 can be exploited remotely because authentication is not required to access the vulnerable systems.
What are the potential impacts of CVE-2023-39457?
Exploitation of CVE-2023-39457 can lead to unauthorized access and control over the affected SCADA systems.