✕
Request a Demo
Rewterz
Rewterz Threat Advisory – ICS: mySCADA myPRO Vulnerability
August 25, 2022
Rewterz
Rewterz Threat Advisory – ICS: Hitachi Energy RTU500 Vulnerability
August 25, 2022

Rewterz Threat Advisory – ICS: Measuresoft ScadaPro Server and Client Vulnerabilities

Severity

High

Analysis Summary

CVE-2022-2892 CVSS:7.8
The affected product uses an unmaintained ActiveX control, which may allow an out-of-bounds write condition while processing a specific project file.

CVE-2022-2894 CVSS:7.8
ScadaPro Server uses unmaintained ActiveX controls. The controls may allow seven untrusted pointer deference instances while processing a specific project file.

CVE-2022-2895 CVSS:7.8
ScadaPro Server uses unmaintained ActiveX controls. These controls may allow two stack-based buffer overflow instances while processing a specific project file. 

CVE-2022-2896 CVSS:7.8
ScadaPro Server allows use after free while processing a specific project file. 

CVE-2022-2897 CVSS:7.8
ScadaPro Server and ScadaPro Server Client do not properly resolve links before file access; this could allow privilege escalation.

CVE-2022-2898 CVSS:6.1
ScadaPro Server and ScadaPro Server Client do not properly resolve links before file access; this could allow a denial-of-service condition.

Impact

  • Code Execution
  • Denia of Service
  • Privilege Escalation

Indicators Of Compromise

CVE

  • CVE-2022-2234

Affected Vendors

Measuresoft

Affected Products

  • ScadaPro Server: Versions prior to 6.8.0.1
  • ScadaPro Server and Client: All Versions

Remediation

Refer to CISA-CERT Advisory for the patch, upgrade, or suggested workaround information.
Measuresoft ScadaPro Server
Measuresoft ScadaPro Server and Client