CVE-2022-23854 is a path traversal vulnerability affecting AVEVA InTouch Access Anywhere versions 2020 R2 and older. This flaw allows an unauthenticated attacker with network access to read arbitrary files outside the secure gateway web server. With a CVSS score of 7.5 (High) and an EPSS score indicating high exploitability, this vulnerability poses a significant risk due to its low attack complexity and potential for sensitive information disclosure. While not in CISA's KEV catalog, public exploit code exists (Metasploit, Nuclei, ExploitDB), and there is notable community discussion and media coverage, suggesting active awareness and potential for exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2020CPE matchmatch criteria | cpe:2.3:a:aveva:intouch_access_anywhere:*:*:*:*:*:*:*:* | ||
2020CPE matchmatch criteria | cpe:2.3:a:aveva:intouch_access_anywhere:2020:-:*:*:*:*:*:* | ||
2020CPE matchmatch criteria | cpe:2.3:a:aveva:intouch_access_anywhere:2020:r2:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.