Description
An Unquoted Search Path or Element issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior; ALC WebCTRL, SiteScan Web 6.1 and prior; ALC WebCTRL, i-Vu 6.0 and prior; ALC WebCTRL, i-Vu, SiteScan Web 5.5 and prior; and ALC WebCTRL, i-Vu, SiteScan Web 5.2 and prior. An unquoted search path vulnerability may allow a non-privileged local attacker to change files in the installation directory and execute arbitrary code with elevated privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Automated Logic Corporation WebCTRL, i-VU, SiteScan | Automated Logic Corporation WebCTRL, i-VU, SiteScan | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Automated Logic WebCTRL 6.5 - Local Privilege Escalation EDB-42542 · local · Aug 22, 2017
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- ICSA-17-234-01 Automated Logic Corporation WebCTRL, i-VU, SiteScan CISA ICS & IT advisories · Aug 22, 2017
References
- 100454 vdb-entry
- https://ics-cert.us-cert.gov/advisories/ICSA-17-234-01
- 42542 exploit