CVE-2023-2187: scada data gateway through 5.01.03 (inclusive); +1 more affected products

Affected technology

scada data gateway · through 5.01.03 (inclusive)
trianglemicroworks

SCADA Data Gateway · 5.01.03
Triangle MicroWorks

Description’s affected range: version <= v5.01.03

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated attacker can send broadcast events to any user via the WebMonitor.An unauthenticated user can use this vulnerability to forcefully log out of any currently logged-in user by sending a "password change event". Vendor/CNA’s CVSS 3.1 assessment (base score 5.3/10) rates confidentiality and integrity impact as none; availability impact as low. NVD’s CVSS 3.1 assessment (base score 5.3/10) rates confidentiality and integrity impact as none; availability impact as low.