5.3med
CVE-2017-60201 exploit
Leao Consultoria e Desenvolvimento de Sistemas (LCDS) LTDA ME LAquis SCADA software versions prior to version 4.1.0.3237 do not neutralize…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
5.3
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
8.5%
percentile 95%
Public exploits
1
Exploit-DB
Summary
Leao Consultoria e Desenvolvimento de Sistemas (LCDS) LTDA ME LAquis SCADA software versions prior to version 4.1.0.3237 do not neutralize external input to ensure that users are not calling for absolute path sequences outside of their privilege level.
Exploit prediction (EPSS)
8.46% probability of exploitation in the next 30 days, higher than 95% of all scored CVEs.
Exploits and detections
- EDB-42885 LAquis SCADA 4.1.0.2385 - Directory Traversal (Metasploit) · remote · 2017-09-27
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
Affected products
- LCDS - Leão Consultoria e Desenvolvimento de Sistemas LTDA ME LAquis SCADA software
Classification
- Weakness
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
- exploit-db.com /exploits/42885/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
- securityfocus.com /bid/97055 · vdb-entry, x_refsource_BID, x_transferred
- ics-cert.us-cert.gov /advisories/ICSA-17-082-01 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2017-6020
- NVD: CVE-2017-6020
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.