ZDI-23-450: (Pwn2Own) Triangle MicroWorks SCADA Data Gateway Restore Workspace Directory Traversal Remote Code Execution Vulnerability
Published Apr 14, 2023
·Updated
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Triangle MicroWorks SCADA Data Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.
Affected Software
1 affected component
Triangle MicroWorks SCADA Data Gateway
Event History
Apr 14, 2023
Advisory Published
05:00 AM
Data Sourced
05:00 AM
Description
Mar 26, 2025
Advisory Published
via ZDI·05:07 AM
Frequently Asked Questions
1
What is the severity of ZDI-23-450?
The severity of ZDI-23-450 is critical due to its potential for remote code execution.
2
How do I fix ZDI-23-450?
To fix ZDI-23-450, immediately update to the latest version of Triangle MicroWorks SCADA Data Gateway that addresses this vulnerability.
3
Who is affected by ZDI-23-450?
Organizations using Triangle MicroWorks SCADA Data Gateway are affected by ZDI-23-450.
4
What type of attack does ZDI-23-450 facilitate?
ZDI-23-450 facilitates remote code execution attacks that can be executed by bypassing authentication.
5
Is authentication required for exploiting ZDI-23-450?
Yes, authentication is required to exploit ZDI-23-450, but it can be bypassed.