Signature Detail

SCADA: ABB MicroSCADA Wserver Component Arbitrary Command Execution

This signature detects attempts to exploit a known vulnerability against the Wserver component of ABB MicroSCADA. It is because user controlled data is passed as command line arguments to the CreateProcessA function enabling arbitrary command execution without access control. A remote unauthenticated attacker can exploit this vulnerability by sending requests with the EXECUTE opcode to the vulnerable service. Successful exploitation could lead to arbitrary command execution in the context of the Wserver process.

References

• BugTraq: 63901