Critical · 9.1 CVE-2022-28223 EUVD-2022-32676GHSA-r37g-6h2f-84v4

Tekon KIO devices through 2022-03-30 allow an authenticated admin user to escalate privileges to root by uploading a malicious Lua plugin.

Published Mar 30, 2022 · Updated Aug 3, 2024 · Assigned by mitre

Description

Tekon KIO devices through 2022-03-30 allow an authenticated admin user to escalate privileges to root by uploading a malicious Lua plugin.

References

https://medium.com/%40bertinjoseb/post-auth-rce-based-in-malicious-lua-plugin-script-upload-scada-controllers-located-in-russia-57044425ac38