CVE-2023-2685 (ao-opc)

A vulnerability was found in AO-OPC server versions mentioned above. As the directory information for the service entry is not enclosed in quotation marks, potential attackers could possibly call up another application than the AO-OPC server by starting the service. The service might be started with system user privileges which could cause a shift in user access privileges.

It is unlikely to exploit the vulnerability in well maintained Windows installations since the attacker would need write access to system folders. …

access application attackers call cve directory entry information opc privileges server service system vulnerability