CVE-2023-2187 Missing authorization in SCADA Data Gateway

What is CVE-2023-2187?

CVE-2023-2187 is a medium-severity missing authorization vulnerability in Triangle MicroWorks SCADA Data Gateway, published on 7 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send broadcast events to any user via the WebMonitor.An unauthenticated user can use this vulnerability to forcefully log out of any currently logged-in user by sending a "password change event". Furthermore, an attacker could use this vulnerability to spam the logged-in user with false events.

Weakness: CWE-306

Which versions are affected by CVE-2023-2187?

It affects 1 product.

Products include Trianglemicroworks Scada Data Gateway.

How do I fix CVE-2023-2187?

No fix has been published for CVE-2023-2187 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-2187 being exploited?

There is no known exploitation of CVE-2023-2187 in the wild and no public exploit code.

Other vulnerabilities in Triangle MicroWorks SCADA Data Gateway

• CVE-2023-39457 Triangle MicroWorks SCADA Data Gateway Missing Authentication Vulnerability Critical 9.8
• CVE-2020-10611 Memory corruption in Triangle MicroWorks SCADA Data Gateway 3.02.0697 through 4.0.122, 2.41.0213 through 4.0.122 Critical 9.8
• CVE-2023-2186 Other in SCADA Data Gateway High 8.2
• CVE-2023-39459 Triangle MicroWorks SCADA Data Gateway Directory Traversal Arbitrary File Creation Vulnerability High 7.8
• CVE-2023-39465 Triangle MicroWorks SCADA Data Gateway Use of Hard-coded Cryptograhic Key Information Disclosure Vulnerability High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qp2h-3p7w-4v89.