Vulnerability Description
A vulnerability was found in AO-OPC server versions mentioned above. As the directory information for the service entry is not enclosed in quotation marks, potential attackers could possibly call up another application than the AO-OPC server by starting the service. The service might be started with system user privileges which could cause a shift in user access privileges. It is unlikely to exploit the vulnerability in well maintained Windows installations since the attacker would need write access to system folders. An update is available that resolves the vulnerability found during an internal review in the product AO-OPC = 3.2.1
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Abb | Ao-Opc | >= 1.0.0, <= 3.2.1 |
Related Weaknesses (CWE)
References
- https://search.abb.com/library/Download.aspx?DocumentID=9AKK108468A4093&LanguageMitigationVendor Advisory
- https://search.abb.com/library/Download.aspx?DocumentID=9AKK108468A4093&LanguageMitigationVendor Advisory
FAQ
What is CVE-2023-2685?
CVE-2023-2685 is a vulnerability with a CVSS score of 7.2 (HIGH). A vulnerability was found in AO-OPC server versions mentioned above. As the directory information for the service entry is not enclosed in quotation marks, potential attackers could possibly call up a...
How severe is CVE-2023-2685?
CVE-2023-2685 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-2685?
Check the references section above for vendor advisories and patch information. Affected products include: Abb Ao-Opc.