QID 591038

AFFECTED PRODUCTS
Zenon All versions up to 8.20

QID Detection Logic (Authenticated)
QID checks for the Vulnerable version using windows registry keys

An attacker who successfully exploited the CVE-2022-34836 vulnerability could access the Zenon runtime activities such as the start and stop of various activity and the last error code etc. The attacker may also craft special private protocol information and perform random file readings on the Zenon system. However, a Zenon system can mitigate the risk by following better control of the access permission and restricting the access only to legitimate clients by using the inbound firewall rules on the Zenon log service An attacker who successfully exploited CVE-2022-34837 may add more network clients that may monitor various activities of the Zenon. However, by reducing the access controls to the network password ini file the risk of attack scenario can be mitigated. An attacker who successfully exploited CVE-2022-34838 may add or alter data points and corresponding attributes. Once such engineering data is used the data visualization will be altered for the end user.