Summary
Successful exploitation of this vulnerability could result in an attacker achieving remote code execution on the underlying operating system when manipulating internal methods through the Java RMI interface. It could also result in escalation of privileges or authentication bypass, which could then result in malicious web code execution or loss of device functionality.
Vulnerabilities 3
-
Critical 9.8
A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow changes to administrative…
-
Critical 9.8
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists…
-
High 7.5
A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause Denial-of-Service when ac…
Revision history
-
#2
Update A - Updated CVE-2023-29412, mitigations section, and affected product version for APC version of product to reflect publicly available exploit found by Schneider.
-
#1
Initial Publication
References
-
ICSA Advisory ICSA-23-108-02 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-23-108-02
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B
-
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ncas/tips/ST04-014