AVEVA InTouch Access Anywhere is a remote access solution for industrial control systems, enabling operators to monitor and manage plant-floor equipment from any location. It is commonly deployed in manufacturing, energy, and utilities to provide secure web-based access to SCADA and HMI applications without requiring VPNs or client software.
CVE-2022-23854 is a path traversal vulnerability that arises due to insufficient input validation in the secure gateway component. An attacker can manipulate file path parameters in HTTP requests to escape the intended web directory and read arbitrary files on the server, including configuration files and credentials.
The vulnerability is triggered through the secure gateway's file serving functionality, specifically by injecting directory traversal sequences (e.g., ../) into the request path. This allows an unauthenticated remote attacker to access files outside the web root, such as /etc/passwd or application configuration files.
If exploited, an attacker could gain access to sensitive system files, including authentication tokens, database credentials, and proprietary industrial process data. This could lead to further network compromise, data exfiltration, or disruption of critical infrastructure operations.
- Update AVEVA InTouch Access Anywhere to version 2020 R2 Patch 01 or later, which includes a fix for CVE-2022-23854.
- Apply strict input validation on all file path parameters to reject directory traversal sequences.
- Restrict network access to the secure gateway using firewall rules to allow only trusted IP addresses.
- Enable web application firewall (WAF) rules to block path traversal attack patterns.
- Implement least privilege file system permissions to limit the impact of file read exploits.
- Monitor logs for unusual HTTP requests containing ../ or encoded traversal sequences.
- Conduct regular vulnerability scans using tools like S4E to detect and remediate such issues promptly.
Get AI-powered remediation steps tailored to your asset.
Try AI Solutions →