CVE-2023-1552 (toolboxst)

ToolboxST prior to version 7.10 is affected by a deserialization vulnerability. An attacker with local access to an HMI or who has conducted a social engineering attack on an authorized operator could execute code in a Toolbox user's context through the deserialization of an untrusted configuration file. Two CVSS scores have been provided to capture the differences between the two aforementioned attack vectors. 

Customers are advised to update to ToolboxST 7.10 which can be found in ControlST 7.10. If unable …

access attack attack vectors capture code configuration context customers cve cvss cvss scores deserialization engineering file gas guidance hmi local social social engineering untrusted update version vulnerability