CVE:CVE-2022-1467
CNNVD:CNNVD-202205-2871
AVEVA InTouch Access Anywhere和AVEVA Plant SCADA Access Anywhere都是英国AVEVA公司的产品。AVEVA InTouch Access Anywhere是一个 InTouch 扩展。允许移动和临时用户通过符合 HTML5 标准的浏览器访问 InTouch 应用程序。AVEVA Plant SCADA Access Anywhere是一个面向工业过程客户的可靠、灵活且高性能的监控和数据采集 （SCADA） 软件解决方案。可以在任何兼容的 Web 浏览器中获得 Plant SCADA 的真正价值和强大功能。
AVEVA InTouch Access Anywhere 和 AVEVA Plant SCADA Access Anywhere 存在安全漏洞。该漏洞源于资源暴露在了错误的领域。攻击者可利用该漏洞执行任意操作系统命令。
solution:Upgrade aveva intouch_access_anywhere to a higher version than *; Upgrade aveva plant_scada_access_anywhere to a higher version than *