CVE-2023-2186

On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send a specially crafted broadcast message including format string characters to perform unrestricted memory reads. This can repeatedly crash the GTWWebMonitor.exe process to cause DoS, and an authenticated user can leverage the vulnerability to leak memory from the process, potentially leading to code execution.

The vulnerability can be exploited by an unauthenticated attacker to cause denial of service (DoS) and by an authenticated user to leak sensitive memory contents, which in an exploit chain could lead to code execution and system compromise.

Update SCADA Data Gateway to a version later than v5.01.03 if available, or apply compensating controls such as restricting network access to the service and monitoring for malformed broadcast messages.