CVE-2022-26043

Name of the Vulnerable Software and Affected Versions Open Automation Software OAS Platform version V16.00.0112

Description The issue concerns the OAS Engine SecureAddSecurity functionality, where a lack of authentication check for a critical function can be exploited. An attacker can send a specially-crafted series of network requests to create a custom Security Group, potentially leading to unauthorized access to the system.

Recommendations For Open Automation Software OAS Platform version V16.00.0112, consider restricting access to the OAS Engine SecureAddSecurity functionality until a patch is available. As a temporary workaround, implement additional authentication checks for critical functions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.