high7.2
CVE-2022-1373
The “restore configuration” feature of Softing Secure Integration Server V1.22 is vulnerable to a directory traversal vulnerability when processing zip files.
Impact
The “restore configuration” feature of Softing Secure Integration Server V1.22 is vulnerable to a directory traversal vulnerability when processing zip files. An attacker can craft a zip file to load an arbitrary dll and execute code. Using the "restore configuration" feature to upload a zip file containing a path traversal file may cause a file to be created and executed upon touching the disk.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Softing | Edgeaggregator | Version 3.1 |
| Softing | Edgeconnector | Version 3.1 |
| Softing | Opc | Version 5.2 |
| Softing | Opc Ua C\+\+ Software Development Kit | Version 6 |
| Softing | Secure Integration Server | Version 1.22 |
| Softing | Uagates | Version 1.74 |