IOServer OPC Server Multiple Vulnerabilities

CVEs (1)

Remediations

• IOServer has created a new version (Version 1.0.19.0IOServer version 1.0.19.0, http://www.ioserver.com/driver19.exe) to correct the directory traversal vulnerability (Vulnerability #3 above). The researcher has found that this new version still contains insufficient access controls (Vulnerability #1) and allows directory listings (Vulnerability #2) inside the root directory and its subdirectories.
• In addition to the patch, the researcher recommends that users ensure that the “Root Directory” configuration value has a trailing backslash. This helps to mitigate the remaining issues, although an attacker can still get a directory listing of the root directory itself (but not subdirectories) with this in place.

Affected Vendors

Affected Products (1)