high·Product Based Web Vulnerabilities·Updated Jan 3, 2024

CVE-2022-23854 Scanner

This scanner tests the secure gateway web server for directory traversal via crafted HTTP requests, allowing unauthenticated file reads outside the web root.

Est. Time~10 seconds
Scan TypeSingle Scan
Targetsurl
CostFree
0
Times Used
by S4E users
0
Assets Scanned
domains & IPs
0
Vulnerabilities Found
confirmed findings
References
CVECVE-2022-23854
7.5
CVSShigh
Exploitable remotely over the internet · no authentication required.

AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated user with network access to read files on the system outside of the secure gateway web server.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
Affected
InTouch Access Anywhereby AVEVA
0
Updated Aug 22, 2026View on NVD →
Detail

AVEVA InTouch Access Anywhere is a remote access solution for industrial control systems, enabling operators to monitor and manage plant-floor equipment from any location. It is commonly deployed in manufacturing, energy, and utilities to provide secure web-based access to SCADA and HMI applications without requiring VPNs or client software.

CVE-2022-23854 is a path traversal vulnerability that arises due to insufficient input validation in the secure gateway component. An attacker can manipulate file path parameters in HTTP requests to escape the intended web directory and read arbitrary files on the server, including configuration files and credentials.

The vulnerability is triggered through the secure gateway's file serving functionality, specifically by injecting directory traversal sequences (e.g., ../) into the request path. This allows an unauthenticated remote attacker to access files outside the web root, such as /etc/passwd or application configuration files.

If exploited, an attacker could gain access to sensitive system files, including authentication tokens, database credentials, and proprietary industrial process data. This could lead to further network compromise, data exfiltration, or disruption of critical infrastructure operations.

Solution Advice
  • Update AVEVA InTouch Access Anywhere to version 2020 R2 Patch 01 or later, which includes a fix for CVE-2022-23854.
  • Apply strict input validation on all file path parameters to reject directory traversal sequences.
  • Restrict network access to the secure gateway using firewall rules to allow only trusted IP addresses.
  • Enable web application firewall (WAF) rules to block path traversal attack patterns.
  • Implement least privilege file system permissions to limit the impact of file read exploits.
  • Monitor logs for unusual HTTP requests containing ../ or encoded traversal sequences.
  • Conduct regular vulnerability scans using tools like S4E to detect and remediate such issues promptly.

Get AI-powered remediation steps tailored to your asset.

Try AI Solutions →

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.