CVE-2017-12728 Privilege escalation in SpiderControl SCADA Web Server
Authenticated non-admin users can escalate privileges to execute arbitrary code in the context of system services on SpiderControl SCADA Web Server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-12728?
CVE-2017-12728 is a high-severity vulnerability in SpiderControl SCADA Web Server, published on 4 Oct 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An Improper Privilege Management issue was discovered in SpiderControl SCADA Web Server Version 2.02.0007 and prior. Authenticated, non-administrative local users are able to alter service executables with escalated privileges, which could allow an attacker to execute arbitrary code under the context of the current system services.
Weakness: CWE-269
Which versions are affected by CVE-2017-12728?
It affects 1 product.
Products include Spidercontrol Scada Webserver.
How do I fix CVE-2017-12728?
No fix has been published for CVE-2017-12728 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-12728 being exploited?
There is no known exploitation of CVE-2017-12728 in the wild and no public exploit code.
Other vulnerabilities in SpiderControl SCADA Web Server
Sources
Also known as GHSA-x5h7-52pq-539h.