CVE-2023-39467: 
Triangle MicroWorks SCADA Data Gateway vulnerability analysis and mitigation

Triangle MicroWorks SCADA Data Gateway contains a certificate information disclosure vulnerability (CVE-2023-39467). The vulnerability was discovered by Uri Katz of Claroty Team82 and was publicly disclosed on August 4, 2023. This security flaw affects installations of Triangle MicroWorks SCADA Data Gateway and allows remote attackers to disclose sensitive information without requiring authentication (ZDI Advisory).

The vulnerability exists within the configuration of certificate web directory in the SCADA Data Gateway. The specific issue results from the exposure of sensitive information in the application webroot. The CVSS score for this vulnerability is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating a medium severity level with network vector attack, low attack complexity, and no authentication required (ZDI Advisory).

An attacker can leverage this vulnerability to disclose sensitive certificate information from affected installations. The exposure of certificate information could potentially compromise the security of encrypted communications and lead to further attacks (ZDI Advisory).

The vulnerability can be exploited remotely by attackers without requiring authentication. The attack complexity is considered low, making it relatively straightforward to exploit (ZDI Advisory).

Triangle MicroWorks has issued an update to correct this vulnerability. Users should upgrade to the latest version of SCADA Data Gateway to protect against this security flaw (ZDI Advisory, Triangle MicroWorks).