title: xArrow SCADA Path Traversal
description: xArrow SCADA versions 7.2 and prior permits unvalidated registry keys to be run with application-level privileges.
problem types: CWE-79: Cross-site Scripting
affected:
{
product: xArrow SCADA
vendor: xArrow
versions:
lessThanOrEqual: 7.2, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N
version: 3.1
]
workarounds: xArrow has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of these affected products who would like to see more responsible security are invited to contact xArrow customer support.