CVE-2023-39458: 
Triangle MicroWorks SCADA Data Gateway vulnerability analysis and mitigation

Triangle MicroWorks SCADA Data Gateway contains an authentication bypass vulnerability (CVE-2023-39458) discovered in May 2024. The vulnerability affects the handling of certificates in the SCADA Data Gateway product, where the service uses a hard-coded default SSL certificate. This security flaw was initially reported as ZDI-CAN-20509 (ZDI Advisory).

The vulnerability has been assigned a CVSS v3.0 base score of 5.3 (Medium) with the vector string AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. The flaw specifically exists within the handling of certificates, where the service implements hard-coded default SSL credentials. The vulnerability has been classified under CWE-798 (Use of Hard-coded Credentials) (NVD).

A successful exploitation of this vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Triangle MicroWorks SCADA Data Gateway. The attack can lead to unauthorized access to the system, potentially exposing sensitive information (ZDI Advisory).

The vulnerability can be exploited by network-adjacent attackers without requiring authentication. While the attack complexity is rated as high, no user interaction is needed for exploitation. The attack requires the attacker to be positioned in an adjacent network to the target system (ZDI Advisory).

Triangle MicroWorks has released an update to address this vulnerability. Users are advised to upgrade to the latest version of SCADA Data Gateway. The fix was included in version 5.01.02, which updated the SCADA Data Gateway to require HTTPS encryption and improved security verification of files (Triangle MicroWorks).