CVE-2020-10612: 
Opto 22 SoftPAC vulnerability analysis and mitigation

The vulnerability (CVE-2020-10612) affects Opto 22 SoftPAC Project Version 9.6 and prior versions. The issue involves improper access control where SoftPACAgent communicates with SoftPACMonitor over network Port 22000 without any restrictions. This vulnerability was disclosed on May 14, 2020, and received a CVSS v3.1 base score of 9.1, indicating Critical severity (CISA Advisory, NVD).

The vulnerability stems from the unrestricted access to Port 22000, which is used for communication between SoftPACAgent and SoftPACMonitor components. The vulnerability has been classified under CWE-862 (Missing Authorization) by NIST and CWE-284 (Improper Access Control) by ICS-CERT. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, indicating network accessibility, low attack complexity, and no required privileges or user interaction (NVD).

Successful exploitation of this vulnerability allows an attacker with network access to gain unauthorized control over the SoftPACAgent service. This includes the ability to update SoftPAC firmware, start or stop services, and write to certain registry values, potentially compromising the system's integrity and availability (CISA Advisory).

The vulnerability is considered highly exploitable due to its network accessibility and lack of required privileges or user interaction. The attack complexity is rated as low, making it relatively straightforward for an attacker to exploit. However, no known public exploits specifically targeting this vulnerability have been reported (CISA Advisory).

Opto 22 has released PAC Project 10.3 to address this vulnerability. Additionally, CISA recommends implementing several defensive measures including: monitoring or restricting Port 22000 at the firewall, minimizing network exposure for control system devices, locating control system networks behind firewalls, and isolating them from the business network. When remote access is required, secure methods such as VPNs should be used (CISA Advisory).