CVE-2020-10620: 
Opto 22 SoftPAC vulnerability analysis and mitigation

CVE-2020-10620 affects Opto 22 SoftPAC Project Version 9.6 and prior versions. The vulnerability was disclosed on May 14, 2020, and involves improper authorization in the SoftPAC communication system. This critical vulnerability affects a virtual PLC system used in various critical infrastructure sectors including Commercial Facilities, Critical Manufacturing, Information Technology, and Transportation Systems, with worldwide deployment (CISA Advisory).

The vulnerability stems from SoftPAC's communication system lacking any credential requirements. It has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-285 (Improper Authorization) and CWE-862 (Missing Authorization), indicating fundamental security control issues in the authentication mechanism (NVD).

Successful exploitation of this vulnerability allows an attacker with network access to directly communicate with SoftPAC without requiring any credentials. This access enables attackers to perform critical operations, including the ability to stop services remotely, potentially causing significant disruption to industrial control systems (CISA Advisory).

The vulnerability is considered highly exploitable due to its network-based attack vector, low attack complexity, and no requirements for privileges or user interaction. The vulnerability can be exploited remotely with low skill level (CISA Advisory).

Opto 22 has released PAC Project 10.3 to address this vulnerability. CISA recommends several mitigation measures including: monitoring or restricting Port 22000 at the firewall, minimizing network exposure for control system devices, locating control system networks behind firewalls, isolating them from business networks, and using secure methods like VPNs when remote access is required (CISA Advisory).