CVE-2022-26303

Name of the Vulnerable Software and Affected Versions Open Automation Software OAS Platform version V16.00.0112

Description The issue concerns the OAS Engine SecureAddUser functionality, where a lack of authentication check for a critical function can be exploited. An attacker can send a specially-crafted series of network requests to create an OAS user account, potentially leading to unauthorized system access.

Recommendations For Open Automation Software OAS Platform version V16.00.0112, consider disabling the SecureAddUser functionality until a patch is available to prevent exploitation. Restrict access to the OAS Engine to minimize the risk of unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.