Skip to content
OpenAdvisories
Critical ICSA-22-109-04 4 CVEs

Elcomplus SmartPTT SCADA

Published Apr 19, 2022 · Updated Apr 19, 2022

Vendor: Elcomplus Product: SmartPTT SCADA

Summary

Successful exploitation of these vulnerabilities could provide attackers a way to traverse the file system to access files or directories that are outside of the restricted directory; allow the upload or transfer files of dangerous types that can be automatically processed within the product's environment; allow an unauthorized access to an action or a resource; or allow a user to store dangerous data in a trusted database.

Vulnerabilities 4

  • Critical 9.8
    CVE-2021-43934

    Elcomplus SmartPtt Unrestricted Upload of File with Dangerous Type

    Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate upload requests, enabling a malicious user to potentially upload arbitrary files.

    Elcomplus SmartPTT
  • Critical 9.0
    CVE-2021-43932

    Elcomplus SmartPtt Cross-site Scripting

    Elcomplus SmartPTT is vulnerable when an attacker injects JavaScript code into a specific parameter that can executed upon accessing the dashboard or the main page.

    Elcomplus SmartPTT
  • High 8.8
    CVE-2021-43939

    Elcomplus SmartPtt Improper Authorization

    Elcomplus SmartPTT is vulnerable when a low-authenticated user can access higher level administration authorization by issuing requests directly to the desired endpoints.

    Elcomplus SmartPTT
  • Medium 4.9
    CVE-2021-43930

    Elcomplus SmartPtt Path Traversal

    Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate download requests, enabling malicious users to perform path traversal attacks and potentially download arbitrary files from the system.

    Elcomplus SmartPTT

Revision history

  1. #1

    ICSA-22-109-04 Elcomplus SmartPPT SCADA

References