Summary
Multiple Wiesemann & Theis software products are affected by a vulnerability through an unquoted search path in the Windows registry. A local attacker can execute arbitrary code and gain administrative privileges by inserting an executable file in the path of the affected product.
Update A, 07.03.2024
Incorrect version numbers have been corrected.
Details
Impact
A local attacker can execute arbitrary code through the affected products and gain administrative privileges by inserting an executable file in a specific path.
Remediation
Remediation
- Update Com Redirector Legacy external link to version 3.94 or higher (Art.No. 00102)
- Update Com Redirector PnP external link to version 4.43 or higher (Art.No. 00111)
- Update OPC-Server external link to version 4.89 or higher (Art.No. 00103)
Vulnerabilities 1
-
High 7.8
Wiesemann & Theis: Multiple products prone to unquoted search path
A local attacker can gain administrative privileges by inserting an executable file in the path of the affected product.
Revision history
-
#3
Fix: reference category, added distribution
-
#2
Update A
-
#1
Initial revision.
References
-
Wiesemann & Theis PSIRT
https://www.wut.de
-
CERT@VDE Security Advisories for Wiesemann & Theis GmbH
https://certvde.com/en/advisories/vendor/wut/
-
VDE-2024-018: Wiesemann & Theis: Multiple products prone to unquoted search path - HTML
https://certvde.com/en/advisories/VDE-2024-018/