Open Automation Software vulnerabilities

We track 13 vulnerabilities in Open Automation Software products across 2 products. 13 are rated high or critical, and none are known to be exploited. The most recent was published on December 6, 2024.

13vulnerabilities

3critical

10high

0exploited

8.1average CVSS score

Latest Open Automation Software vulnerabilities

7.8 High severity
Open Automation Software: Incorrect Permission Assignment for Critical Resource
CVE-2024-11220Dec 6, 2024Open Automation Software
A local low-level user on the server machine with credentials to the running OAS services can create and execute a report with an rdlx file on the server system itself. Any code within the rdlx file of the report executes with SYSTEM privileges, resulting in p
8.1 High severity
OAS Platform: Improper Authentication
CVE-2023-34998Sep 5, 2023Open Automation SoftwareEPSS 1.2%
An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to arbitrary authentication. An attacker can sniff network traffic to tr
7.5 High severity
OAS Platform: Use of Insufficiently Random Values
CVE-2023-34353Sep 5, 2023Open Automation SoftwareEPSS 1.21%
An authentication bypass vulnerability exists in the OAS Engine authentication functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted network sniffing can lead to decryption of sensitive information. An attacker can sniff netwo
8.1 High severity
OAS Platform: Externally Controlled Reference to a Resource in Another Sphere
CVE-2023-32615Sep 5, 2023Open Automation Software
A file write vulnerability exists in the OAS Engine configuration functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to arbitrary file creation or overwrite. An attacker can send a sequen
9.8 Critical severity
OAS Platform: Improper Authentication
CVE-2023-31242Sep 5, 2023Open Automation SoftwareEPSS 3.48%
An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A specially-crafted series of network requests can lead to arbitrary authentication. An attacker can send a sequence of requests
7.5 High severity
OAS Platform: Missing Authentication for Critical Functionality
CVE-2022-27169May 25, 2022Open Automation SoftwareEPSS 1.74%
An information disclosure vulnerability exists in the OAS Engine SecureBrowseFile functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted network request can lead to a disclosure of sensitive information. An attacker can send a
9.4 Critical severity
OAS Platform: Missing Authentication for Critical Functionality
CVE-2022-26833May 25, 2022Open Automation SoftwareEPSS 37.6%
An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HT
7.5 High severity
OAS Platform: Missing Authentication for Critical Functionality
CVE-2022-26303May 25, 2022Open Automation SoftwareEPSS 1.28%
An external config control vulnerability exists in the OAS Engine SecureAddUser functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted series of network requests can lead to the creation of an OAS user account. An attacker can
9.8 Critical severity
OAS Platform: Missing Authentication for Critical Functionality
CVE-2022-26082May 25, 2022Open Automation SoftwareEPSS 20.1%
A file write vulnerability exists in the OAS Engine SecureTransferFiles functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted series of network requests can lead to remote code execution. An attacker can send a sequence of req
7.5 High severity
OAS Platform: Cleartext Transmission of Sensitive Information
CVE-2022-26077May 25, 2022Open Automation SoftwareEPSS 1.16%
A cleartext transmission of sensitive information vulnerability exists in the OAS Engine configuration communications functionality of Open Automation Software OAS Platform V16.00.0112. A targeted network sniffing attack can lead to a disclosure of sensitive i
7.5 High severity
OAS Platform: Missing Authentication for Critical Functionality
CVE-2022-26067May 25, 2022Open Automation SoftwareEPSS 1.36%
An information disclosure vulnerability exists in the OAS Engine SecureTransferFiles functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted series of network requests can lead to arbitrary file read. An attacker can send a sequ
7.5 High severity
OAS Platform: Missing Authentication for Critical Functionality
CVE-2022-26043May 25, 2022Open Automation SoftwareEPSS 1.28%
An external config control vulnerability exists in the OAS Engine SecureAddSecurity functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted series of network requests can lead to the creation of a custom Security Group. An attac
7.5 High severity
OAS Platform: Missing Authentication for Critical Functionality
CVE-2022-26026May 25, 2022Open Automation SoftwareEPSS 1.22%
A denial of service vulnerability exists in the OAS Engine SecureConfigValues functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted network request can lead to loss of communications. An attacker can send a network request to