Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2017-12694: SpiderControl SCADA Web Server allows attackers to read system files
CVE-2017-12694 · published 9 years ago
Summary
The SpiderControl SCADA Web Server can be tricked by a basic web request into revealing files stored on the server. This could expose sensitive configuration or data to anyone on the network. Apply the vendor's security update or restrict access to the web interface until it is patched.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| spidercontrol | scada_web_server |
All versions
cpe:2.3:a:spidercontrol:scada_web_server:-:*:*:*:*:*:*:* |
Original advisory text
A Directory Traversal issue was discovered in SpiderControl SCADA Web Server. An attacker may be able to use a simple GET request to perform a directory traversal into system files.
A Directory Traversal issue was discovered in SpiderControl SCADA Web Server. An attacker may be able to use a simple GET request to perform a directory traversal into system files.
References
- http://www.securityfocus.com/bid/100456 Third Party Advisory VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-17-234-03 Mitigation Third Party Advisory US Government Resource
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-22Path Traversal
Timeline
Published25 Aug 2017
Updated23 Oct 2026
First seen29 Sep 2026
Sources
CVE-2017-12694 · NVD
Track software like this
Free during beta