Vulnerability · Published Jun 27, 2024 · Assigned by icscert
CVE-2024-2882Missing Authorization in SDG Technologies PnPSCADA
Critical 9.3
In plain English
A critical-severity missing authorization in PnPSCADA from SDG Technologies. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Severity (CVSS 4.0)9.3Critical
Exploit odds (30 days)0.7%top 48.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
SDG Technologies PnPSCADA allows a remote attacker to attach various entities without requiring system authentication. This breach could potentially lead to unauthorized control, data manipulation, and access to sensitive information within the SCADA system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SDG Technologies | PnPSCADA | 0 – before 4 |
Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-179-02 government-resource