ZDI-CAN-20537: ZDI-23-1031: (Pwn2Own) Triangle MicroWorks SCADA Data Gateway Trusted Certification Unrestricted Upload of File Remote Code Execution Vulnerability
First published: Fri Aug 04 2023(Updated: )
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Triangle MicroWorks SCADA Data Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Trianglemicroworks SCADA Data Gateway |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of ZDI-CAN-20537?
ZDI-CAN-20537 is classified as a critical vulnerability that allows remote code execution.
How do I fix ZDI-CAN-20537?
To fix ZDI-CAN-20537, ensure that you update the Triangle MicroWorks SCADA Data Gateway to the latest version that addresses this vulnerability.
Who is affected by ZDI-CAN-20537?
Organizations using Triangle MicroWorks SCADA Data Gateway are affected by ZDI-CAN-20537.
Can ZDI-CAN-20537 be exploited without authentication?
No, ZDI-CAN-20537 requires authentication, but the existing authentication can be bypassed.
What type of vulnerability is ZDI-CAN-20537?
ZDI-CAN-20537 is a remote code execution vulnerability.
- collector/zdi-published
- alias/ZDI-CAN-20537
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/title
- agent/description
- agent/softwarecombine
- agent/event
- agent/source
- agent/type
- agent/tags
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-23-1031
- alias/CVE-2023-39463
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/triangle microworks
- canonical/trianglemicroworks scada data gateway