ZDI-CAN-20538: ZDI-23-1032: (Pwn2Own) Triangle MicroWorks SCADA Data Gateway GTWWebMonitorService Unquoted Search Path Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute code on affected installations of Triangle MicroWorks SCADA Data Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-20538?
The severity of ZDI-CAN-20538 is classified as critical due to the potential for remote code execution.
How do I fix ZDI-CAN-20538?
To mitigate ZDI-CAN-20538, update the Triangle MicroWorks SCADA Data Gateway to the latest version that addresses this vulnerability.
Who is affected by ZDI-CAN-20538?
ZDI-CAN-20538 affects installations of Triangle MicroWorks SCADA Data Gateway that utilize the vulnerable authentication mechanism.
What type of vulnerability is ZDI-CAN-20538?
ZDI-CAN-20538 is a remote code execution vulnerability that allows attackers to execute malicious code on the affected systems.
Is authentication required to exploit ZDI-CAN-20538?
Yes, while authentication is required, the vulnerability allows existing authentication mechanisms to be bypassed.