CVE-2022-23854

Deeper analysis

AVEVA InTouch Access Anywhere versions 2020 R2 and older contain a path traversal vulnerability that permits an unauthenticated network attacker to read arbitrary files on the underlying system outside the secure gateway web server directory. The flaw is tracked under CWE-22 and CWE-23 and carries a CVSS 3.1 base score of 7.5 reflecting network attack vector, low complexity, and high confidentiality impact without requiring authentication or user interaction.

An attacker with network reachability to the exposed secure gateway can supply crafted path sequences in HTTP requests to traverse directories and retrieve sensitive files such as configuration data or credentials stored on the host. Because the vector requires no credentials, the exposure extends to any internet-facing or poorly segmented deployment of the affected versions.

Vendor and government advisories, including AVEVA Security Bulletin AVEVA-2023-001 and CISA ICSA-22-342-02, direct users to apply the patches released for InTouch Access Anywhere or to restrict network access to the secure gateway until updates can be installed. The referenced technical analysis from crisec.de further details request patterns that trigger the traversal and confirms the need for both patching and network segmentation.

The CVE maintains a high EPSS score with a current value of 0.9218 and a recorded peak of 0.9274, indicating sustained exploitation interest after disclosure.