Vulnerability · Published May 14, 2020 · Assigned by icscert
CVE-2020-10612
Critical 9.1
In plain English
A critical-severity improper access control in Opto 22 SoftPAC Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).
Severity (CVSS NVD)9.1Critical
Exploit odds (30 days)1.1%top 34.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Opto 22 SoftPAC Project Version 9.6 and prior. SoftPACAgent communicates with SoftPACMonitor over network Port 22000. However, this port is open without any restrictions. This allows an attacker with network access to control the SoftPACAgent service including updating SoftPAC firmware, starting or stopping service, or writing to certain registry values.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Opto 22 SoftPAC Project | SoftPAC Project Version 9.6 and prior |
Weakness: CWE-284
References
- https://www.us-cert.gov/ics/advisories/icsa-20-135-01 x_refsource_MISC