SQL Injection in Ardereg Sistemas Scada
CVE-2023-4485
ARDEREG Sistema SCADA Central versions 2.203 and prior login page are vulnerable to an unauthenticated blind SQL injection attack. An attacker could manipulate the application's SQL query logic to extract sensitive information or perform unauthorized actions within the database. In this case, the vulnerability could allow an attacker to execute arbitrary SQL queries through the login page, potentially leading to unauthorized access, data leakage, or even disruption of critical industrial processes.
Vulnerability class: SQL Injection
EPSS: 0.006 (45.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Ardereg Sistemas Scada — versions 0
- Ardereg Sistemas_scada
Weakness classification (CWE)
Public proof-of-concept exploits
References
- ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory)
Frequently asked questions
- What is CVE-2023-4485?
- CVE-2023-4485 is a critical-severity vulnerability in Ardereg Sistemas Scada, classified under SQL Injection. CVSS score: 9.8/10. Published 2023-09-06.
- How severe is CVE-2023-4485?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2023-4485 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.