| Article No° | Product Name | Affected Version(s) |
|---|---|---|
| 00102 | Com Redirector Legacy | <= 3.93 |
| 00111 | Com Redirector PnP | <= 4.42 |
| 00103 | OPC-Server | <= 4.88 |
Multiple Wiesemann & Theis software products are affected by a vulnerability through an unquoted search path in the Windows registry. A local attacker can execute arbitrary code and gain administrative privileges by inserting an executable file in the path of the affected product.
Update A, 07.03.2024
Incorrect version numbers have been corrected.
A local attacker can gain administrative privileges by inserting an executable file in the path of the affected product.
A local attacker can execute arbitrary code through the affected products and gain administrative privileges by inserting an executable file in a specific path.
Remediation
Update Com Redirector Legacy to version 3.94 or higher (Art.No. 00102)
Update Com Redirector PnP to version 4.43 or higher (Art.No. 00111)
Update OPC-Server to version 4.89 or higher (Art.No. 00103)
CERT@VDE coordinated with Wiesemann & Theis