CVE-2022-1467

EUVD-2022-24770
Windows OS can be configured to overlay a “language bar” on top of any application. When this OS functionality is enabled, the OS language bar UI will be viewable in the browser alongside the AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere applications. It is possible to manipulate the Windows OS language bar to launch an OS command prompt, resulting in a context-escape from application into OS.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.4 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
icscertCNA
7.4 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 50%
Affected Products (NVD)
VendorProductVersion
avevaintouch_access_anywhere
*
avevaplant_scada_access_anywhere
*
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.aveva.com/en/support-and-success/cyber-security-updates/
https://www.cisa.gov/uscert/ics/advisories/icsa-22-130-05
https://www.aveva.com/en/support-and-success/cyber-security-updates/
https://www.cisa.gov/uscert/ics/advisories/icsa-22-130-05