Skip to content
OpenAdvisories
Critical ICSA-22-109-05 5 CVEs

Elcomplus SmartPTT SCADA Server

Published Apr 19, 2022 · Updated Apr 19, 2022

Vendor: Elcomplus Product: SmartPTT SCADA Server

Summary

Successful exploitation of these vulnerabilities could allow an unauthorized user to store dangerous data in a trusted database; potentially exposing sensitive information; allow malicious users to upload arbitrary files; provide attackers a way to traverse the file system to access files or directories that are outside of the restricted directory; or result in exposure of data or unintended code execution.

Vulnerabilities 5

  • Critical 9.8
    CVE-2021-43934

    Elcomplus SmartPtt Unrestricted Upload of File with Dangerous Type

    Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate upload requests, enabling a malicious user to potentially upload arbitrary files.

    Elcomplus SmartPTT
  • Critical 9.0
    CVE-2021-43932

    Elcomplus SmartPtt Cross-site Scripting

    Elcomplus SmartPTT is vulnerable when an attacker injects JavaScript code into a specific parameter that can executed upon accessing the dashboard or the main page.

    Elcomplus SmartPTT
  • High 8.1
    CVE-2021-43938

    Elcomplus SmartPTT SCADA Server Information Exposure

    Elcomplus SmartPTT SCADA Server is vulnerable to an unauthenticated user can request various files from the server without any authentication or authorization.

    Elcomplus SmartPTT SCADA Server
  • High 7.6
    CVE-2021-43937

    Elcomplus SmartPTT SCADA Server Cross-site Request Forgery

    Elcomplus SmartPTT SCADA Server web application does not, or cannot, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

    Elcomplus SmartPTT SCADA Server
  • Medium 4.9
    CVE-2021-43930

    Elcomplus SmartPtt Path Traversal

    Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate download requests, enabling malicious users to perform path traversal attacks and potentially download arbitrary files from the system.

    Elcomplus SmartPTT

Revision history

  1. #1

    ICSA-22-109-05 Elcomplus SmartPPT SCADA Server

References