VulnerabilityDeferred

CVE-2024-10313

iniNet Solutions SpiderControl SCADA PC HMI Editor has a path traversal vulnerability.

HIGH 8.6EPSS 0.47%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.47%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

iniNet Solutions SpiderControl SCADA PC HMI Editor has a path traversal vulnerability. When the software loads a malicious ‘ems' project template file constructed by an attacker, it can write files to arbitrary directories. This can lead to overwriting system files, causing system paralysis, or writing to startup items, resulting in remote control.

CVSS 4.0: 8.6 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.47% probability · 39th percentile
CISA KEV: Not listed
Weakness: CWE-22
Source: ics-cert@hq.dhs.gov

References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-298-02

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.