Skip to content
OpenAdvisories
Medium ICSA-21-229-03 3 CVEs

xArrow SCADA

Published Aug 17, 2021 · Updated Aug 17, 2021

Vendor: xArrow Product: SCADA

Summary

Successful exploitation of these vulnerabilities could result in remote code execution.

Vulnerabilities 3

  • Medium 6.1
    CVE-2021-33001

    xArrow SCADA Cross-site Scripting

    xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘bdate’ of the resource xhisvalue.htm, which may allow an unauthorized attacker to execute arbitrary code.

    xArrow xArrow SCADA
  • Medium 6.1
    CVE-2021-33021

    xArrow SCADA Cross-site Scripting

    xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘edate’ of the resource xhisalarm.htm, which may allow an unauthorized attacker to execute arbitrary code.

    xArrow xArrow SCADA
  • Medium 5.6
    CVE-2021-33025

    xArrow SCADA Path Traversal

    xArrow SCADA versions 7.2 and prior permits unvalidated registry keys to be run with application-level privileges.

    xArrow xArrow SCADA

Revision history

  1. #1

    ICSA-21-229-03 xArrow SCADA

References