Description
A local low-level user on the server machine with credentials to the running OAS services can create and execute a report with an rdlx file on the server system itself. Any code within the rdlx file of the report executes with SYSTEM privileges, resulting in privilege escalation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Open Automation Software | Open Automation Software | < V20.00.0076 | V20.00.0076 |
Advisories 1
- ICSA-24-338-03 Open Automation Software CISA ICS & IT advisories · Dec 3, 2024