CVE-2023-39465

HIGH

Triangle MicroWorks SCADA Data Gateway - Sensitive Information Disclosure via Hard-coded Key

Title source: llm
STIX 2.1

Description

Triangle MicroWorks SCADA Data Gateway Use of Hard-coded Cryptograhic Key Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Triangle MicroWorks SCADA Data Gateway. Authentication is not required to exploit this vulnerability. The specific flaw exists within the TmwCrypto class. The issue results from the usage of a hard-coded cryptograhic key and the usage of a hard-coded certificate. An attacker can leverage this vulnerability to disclose sensitive information. Was ZDI-CAN-20615.

References (2)

Core 2
Core References
Third Party Advisory x_research-advisory
https://www.zerodayinitiative.com/advisories/ZDI-23-1033/

Scores

CVSS v3 7.5
EPSS 0.0071
EPSS Percentile 48.4%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-321
Status published
Products (1)
trianglemicroworks/scada_data_gateway 5.1.3.20324
Published May 03, 2024
Tracked Since Feb 18, 2026