Vulnetix
Try Vulnetix Request Demo
CVE-2023-22611 PUBLISHED CVSS 7.5 HIGH

Windows OS can be configured to overlay a “language bar” on top of any application. When this OS functionality is enabled, the OS language bar UI will be viewable in the browser alongside the AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere applications. It is possible to manipulate the Windows OS language bar to launch an OS command prompt, resulting in a context-escape from application into OS.

EPSS 0.42% · 62.0th percentile

Risk Scores

CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score
0.42%
62.0th percentile

Affected Products

VendorProductVersions
schneider-electricecostruxure_geo_scada_expert_202184.8027.1, 84.8120.1, 84.8108.1
Schneider ElectricEcoStruxure Geo SCADA Expert 2019 - 2021 (formerly known as ClearSCADA)All
AVEVAAVEVA Plant SCADA Access Anywhereall
schneider-electricecostruxure_geo_scada_expert_202083.7913.1, 83.7551.1, 83.7578.1
AVEVAAVEVA InTouch Access Anywhereall
schneider-electricecostruxure_geo_scada_expert_201981.7578.1, 81.7545.1, 81.7522.1

Timeline

References

Open in Interactive Console →