Vulnerability · Published May 23, 2022 · Assigned by icscert

CVE-2022-1467AVEVA InTouch Access Anywhere Exposure of Resource to Wrong Sphere

High 7.4

In plain English

A high-severity security flaw in AVEVA InTouch Access Anywhere from AVEVA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)1.0%top 37.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Windows OS can be configured to overlay a “language bar” on top of any application. When this OS functionality is enabled, the OS language bar UI will be viewable in the browser alongside the AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere applications. It is possible to manipulate the Windows OS language bar to launch an OS command prompt, resulting in a context-escape from application into OS.

Affected products (as reported)

Vendor	Product	Versions
AVEVA	AVEVA InTouch Access Anywhere	all
AVEVA	AVEVA Plant SCADA Access Anywhere	all

Weakness: CWE-668 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

References

https://www.aveva.com/en/support-and-success/cyber-security-updates/ x_refsource_MISC
https://www.cisa.gov/uscert/ics/advisories/icsa-22-130-05 x_refsource_MISC