LAquis SCADA ICSA-19-073-01 Arbitrary Code Execution Vulnerability

Bugtraq ID:	107418
Class:	Design Error
CVE:	CVE-2019-6536
Remote:	Yes
Local:	No
Published:	Mar 14 2019 12:00AM
Updated:	Mar 14 2019 12:00AM
Credit:	Mat Powell, working with Zero Day Initiative
Vulnerable:	LCDS - Leão Consultoria e Desenvolvimento de Sistemas LTDA ME LAquis SCADA 4.1.0.4150
Not Vulnerable:	LCDS - Leão Consultoria e Desenvolvimento de Sistemas LTDA ME LAquis SCADA 4.3.1.71

LAquis SCADA ICSA-19-073-01 Arbitrary Code Execution Vulnerability

LAquis SCADA is prone to an arbitrary code-execution vulnerability.

A remote attacker may exploit this issue to execute arbitrary code in the context of the affected application. Failed attempts will likely cause a denial-of-service condition.

LAquis SCADA 4.1.0.4150 is vulnerable; other versions may also be vulnerable.

LAquis SCADA ICSA-19-073-01 Arbitrary Code Execution Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]

LAquis SCADA ICSA-19-073-01 Arbitrary Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

LAquis SCADA ICSA-19-073-01 Arbitrary Code Execution Vulnerability

References:

• Laquisscada homepage (LCDS)
  
• Advisory (ICSA-19-073-01) LCDS - Leão Consultoria e Desenvolvimento de Sistemas (ICS-CERT)