Unquoted Windows search path vulnerability in Moxa Active OPC Server before 2.4.19 allows local users to gain privileges via a Trojan horse executable file in the %SYSTEMDRIVE% directory.
The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
Link | Tags |
---|---|
https://ics-cert.us-cert.gov/advisories/ICSA-16-264-01 | third party advisory us government resource |
http://www.securityfocus.com/bid/93046 | vdb entry |