Most recent entries from all

cnvd-2021-103632

EUVD-2026-27948

fkie_cve-2021-32498

SICK SOPAS ET before version 4.8.0 allows attackers to manipulate the pathname of the emulator and use path traversal to run an arbitrary executable located on the host system. When the user starts the emulator from SOPAS ET the corresponding executable will be started instead of the emulator

GHSA-wprm-j8wf-78v5

gsd-2021-32498

SCA-2021-0004 — Vulnerabilities in SICK SOPAS ET

SDD files might contain an executable file that will be listed as the Emulators inside SOPAS ET. When a user starts the emulator, the executable is run without further checks. Attackers could wrap any executable file into an SDD and provide this to a SOPAS ET user. When installing the SDD the user may not be aware about the executable inside of the SDD. When an SDD contains an emulator, the emulator location is part of the SDD manifest. Attackers could manipulate this location and use path traversal to target an arbitrary executable located on the host system. When the user starts the emulator from SOPAS ET, the corresponding executable will be started instead of the emulator. The command line arguments that are passed to an emulator when starting it via SOPAS ET, are part of the SDD manifest. Attackers could manipulate the arguments to pass in any value to the executable. In combination with CVE-2021-32498 the attacker could target an arbitrary executable with any arguments on the host system.