ZDI-23-1032: (Pwn2Own) Triangle MicroWorks SCADA Data Gateway GTWWebMonitorService Unquoted Search Path Remote Code Execution Vulnerability
First published: Fri Aug 04 2023(Updated: )
This vulnerability allows remote attackers to execute code on affected installations of Triangle MicroWorks SCADA Data Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Trianglemicroworks SCADA Data Gateway |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of ZDI-23-1032?
The severity of ZDI-23-1032 is high due to the potential for remote code execution.
How do I fix ZDI-23-1032?
To fix ZDI-23-1032, apply the latest security patches released by Triangle MicroWorks for SCADA Data Gateway.
What systems are affected by ZDI-23-1032?
ZDI-23-1032 affects installations of Triangle MicroWorks SCADA Data Gateway.
Can ZDI-23-1032 be exploited without authentication?
No, ZDI-23-1032 requires authentication, but the authentication mechanism can be bypassed.
What kind of impact can ZDI-23-1032 have on systems?
ZDI-23-1032 can allow remote attackers to execute arbitrary code on affected systems.
- collector/zdi-published
- alias/ZDI-CAN-20538
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/title
- agent/description
- agent/softwarecombine
- agent/event
- agent/source
- agent/tags
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-23-1032
- alias/CVE-2023-39464
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/triangle microworks
- canonical/trianglemicroworks scada data gateway