Incorrect Permission Assignment for Critical Resource in Rapid SCADA
In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an authorized user can write directly to the Scada directory. This may allow privilege escalation.
Description: CWE-732 Incorrect Permission Assignment for Critical Resource
Metrics
Version
Base score
Base severity
Vector
3.1
7.8
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Version:3.1
Base score:7.8
Base severity: HIGH
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Metrics Other Info
Impacts
CAPEC ID
Description
Solutions
Configurations
Workarounds
Rapid Software did not respond to CISA's attempts at coordination. Users
of Rapid SCADA are encouraged to contact Rapid Software and keep their
systems up to date.
Exploits
Credits
finder
Noam Moshe of Claroty Research reported these vulnerabilities to CISA.