Skip to main content

Scadapro Server CVE-2022-2894

HIGH
Untrusted Pointer Dereference (CWE-822)
2022-08-31 ics-cert@hq.dhs.gov
Information Disclosure Scadapro Server
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Aug 31, 2022 - 21:15 nvd
HIGH 7.8

DescriptionNVD

Measuresoft ScadaPro Server (All Versions) uses unmaintained ActiveX controls. The controls may allow seven untrusted pointer deference instances while processing a specific project file.

AnalysisAI

Measuresoft ScadaPro Server (All Versions) uses unmaintained ActiveX controls. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-822. Measuresoft ScadaPro Server (All Versions) uses unmaintained ActiveX controls. The controls may allow seven untrusted pointer deference instances while processing a specific project file. Affected products include: Measuresoft Scadapro Server.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Scadapro Server

View all
CVE-2022-3263 HIGH
7.8 Sep 23

The security descriptor of Measuresoft ScadaPro Server version 6.7 has inconsistent permissions, which could allow a loc
CVE-2022-2897 HIGH
7.8 Aug 31

Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow
CVE-2022-2896 HIGH
7.8 Aug 31

Measuresoft ScadaPro Server (All Versions) allows use after free while processing a specific project file. Rated high se
CVE-2022-2895 HIGH
7.8 Aug 31

Measuresoft ScadaPro Server (All Versions) uses unmaintained ActiveX controls. Rated high severity (CVSS 7.8), this vuln
CVE-2022-2892 HIGH
7.8 Aug 31

Measuresoft ScadaPro Server (Versions prior to 6.8.0.1) uses an unmaintained ActiveX control, which may allow an out-of-
CVE-2012-1824 HIGH
7.2 May 25

Untrusted search path vulnerability in Measuresoft ScadaPro Client before 4.0.0 and ScadaPro Server before 4.0.0 allows

CVE-2024-3746 MEDIUM
6.8 Apr 30

The entire parent directory - C:\ScadaPro and its sub-directories and files are configured by default to allow user, inc
CVE-2022-2898 MEDIUM
5.5 Aug 31

Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow

Same weakness CWE-822 – Untrusted Pointer Dereference

View all
CVE-2024-35250 HIGH POC
7.8
CVE-2023-21768 HIGH POC
7.8
CVE-2024-21338 HIGH POC
7.8
CVE-2025-50165 CRITICAL
9.8
CVE-2026-33120 HIGH
8.8
CVE-2023-1437 CRITICAL
9.8
CVE-2018-17893 CRITICAL
9.8
CVE-2018-14811 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2022-2894 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy