LCDS – Leão Consultoria e Desenvolvimento de Sistemas LTDA ME LAquis SCADA Access Control Vulnerability
Vendor: LCDS – Leão Consultoria e Desenvolvimento de Sistemas LTDA ME
Equipment: LAquis SCADA
Vulnerability: Improper Access Control
The following versions of LAquis SCADA, an industrial automation software, are affected:
LAquis SCADA software, Versions 4.1 and prior versions released before January 20, 2017.
Successful exploitation of this vulnerability could allow authenticated system users to escalate their privileges and modify or replace application files.
IMPROPER ACCESS CONTROL CWE-284
An Improper Access Control vulnerability has been identified, which may allow an authenticated user to modify application files to escalate privileges.
CVE-2017-6016 has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).
SCADA LAquis software is vulnerable to local privilege escalation. EVERYONE has FULL permissions over all the install files (*exe,*dll), therefore, it is possible for any local, authenticated, non-admin user to replace/modify original application files with malicious ones, and gain higher privileged access once an administrative user runs the application. Other vectors are possible as well.