ZDI-23-1028: (Pwn2Own) Triangle MicroWorks SCADA Data Gateway Event Log Directory Traversal Arbitrary File Creation Vulnerability
This vulnerability allows remote attackers to create arbitrary files on affected installations of Triangle MicroWorks SCADA Data Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-23-1028?
The severity of ZDI-23-1028 is considered high due to its potential for remote attackers to create arbitrary files.
How do I fix ZDI-23-1028?
To fix ZDI-23-1028, update the Triangle MicroWorks SCADA Data Gateway to the latest version that addresses this vulnerability.
What type of authentication is affected by ZDI-23-1028?
ZDI-23-1028 affects the existing authentication mechanism, which can be bypassed by attackers.
Can ZDI-23-1028 be exploited without authentication?
No, ZDI-23-1028 requires authentication; however, the existing authentication can be bypassed.
What systems are affected by ZDI-23-1028?
ZDI-23-1028 affects installations of Triangle MicroWorks SCADA Data Gateway.