CVE-2022-26082

Name of the Vulnerable Software and Affected Versions Open Automation Software OAS Platform version V16.00.0112

Description A file write vulnerability exists in the OAS Engine SecureTransferFiles functionality, allowing remote code execution through a specially-crafted series of network requests. The vulnerability is also related to a lack of authentication for a critical function, which can be exploited by a remote attacker to execute arbitrary code.

Recommendations For Open Automation Software OAS Platform version V16.00.0112, consider disabling the SecureTransferFiles functionality until a patch is available to prevent remote code execution. Restrict access to critical functions that lack authentication to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.