Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2017-6020: LAquis SCADA permits unauthorized file access
CVE-2017-6020 · published 8 years ago
Summary
Versions of the LAquis SCADA system before 4.1.0.3237 can be tricked into using file paths that are outside a user's allowed area. This could let an attacker read or modify files they should not access. Upgrade to the latest version or apply the vendor's patch to stop this behavior.
What to do
- Update lcds laquis_scada to version 4.1.0.3237 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| lcds | laquis_scada |
< 4.1.0.3237 cpe:2.3:a:lcds:laquis_scada:*:*:*:*:*:*:*:* |
Original advisory text
Leao Consultoria e Desenvolvimento de Sistemas (LCDS) LTDA ME LAquis SCADA software versions prior to version 4.1.0.3237 do not neutralize external input to ensure that users are not calling for ab...
Leao Consultoria e Desenvolvimento de Sistemas (LCDS) LTDA ME LAquis SCADA software versions prior to version 4.1.0.3237 do not neutralize external input to ensure that users are not calling for absolute path sequences outside of their privilege level.
References
- http://www.securityfocus.com/bid/97055 Third Party Advisory VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-17-082-01 Third Party Advisory US Government Resource
- https://www.exploit-db.com/exploits/42885/ Third Party Advisory VDB Entry
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-22Path Traversal
Timeline
Published17 Apr 2018
Updated15 Oct 2026
First seen29 Sep 2026
Sources
CVE-2017-6020 · NVD
Track software like this
Free during beta