CVE-2023-39466: 
Triangle MicroWorks SCADA Data Gateway vulnerability analysis and mitigation

Triangle MicroWorks SCADA Data Gateway contains a vulnerability (CVE-2023-39466) that allows remote attackers to disclose sensitive information without requiring authentication. The vulnerability was discovered in August 2023 and affects the get_config endpoint of the SCADA Data Gateway software (ZDI Advisory).

The vulnerability exists within the get_config endpoint of the SCADA Data Gateway. The issue stems from the lack of authentication prior to allowing access to functionality. The vulnerability has been assigned a CVSS score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating a medium severity with network-based attack vector requiring no privileges or user interaction (ZDI Advisory).

An attacker can leverage this vulnerability to disclose sensitive information from affected installations of the SCADA Data Gateway without requiring any authentication (ZDI Advisory).

The vulnerability can be exploited remotely by an unauthenticated attacker. No special privileges or user interaction is required to exploit this vulnerability, making it relatively straightforward to exploit (ZDI Advisory).

Triangle MicroWorks has released an update to address this vulnerability. Users should upgrade to the latest version of SCADA Data Gateway. The fix was included in version 5.01.03 which addresses vulnerability ICSA-22-249-01 (Triangle MicroWorks).