Vulnerability record · CVE-2022-23854 · published 23 December 2022
CVE-2022-23854: AVEVA InTouch Access Anywhere path traversal allows unauthenticated file read
Aveva · Intouch Access Anywhere
AVEVA InTouch Access Anywhere 2020 R2 and older contain a path traversal flaw in the secure gateway web server. An unauthenticated attacker with network access can read files outside the web server's intended directory. Because the gateway sits in front of industrial HMI/SCADA access, exposed file reads can leak configuration, credential or system data.
Description
AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated user with network access to read files on the system outside of the secure gateway web server.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Automated analysis
high priorityUnauthenticated network-reachable file read on an industrial access gateway with a high EPSS score, though no KEV listing or confirmed exploit code.
What it is
AVEVA InTouch Access Anywhere 2020 R2 and older contain a path traversal flaw in the secure gateway web server. An unauthenticated attacker with network access can read files outside the web server's intended directory. Because the gateway sits in front of industrial HMI/SCADA access, exposed file reads can leak configuration, credential or system data.
Impact
An attacker gains read access to arbitrary files on the host reachable by the gateway process, potentially exposing credentials, configuration and system information. No write, code execution or denial of service is described in the record.
Attack surface
Reached over the network against the secure gateway web server; the CVSS vector shows no privileges and no user interaction required. Any internet- or network-exposed InTouch Access Anywhere gateway is directly reachable.
Exploitation
Not listed in CISA KEV and no ransomware association is recorded, but EPSS is high at roughly 0.46 (98.75th percentile), indicating elevated likelihood of attempted exploitation. Reference tags are advisory-only, so no public exploit code is confirmed by this record.
What to do
- Upgrade InTouch Access Anywhere beyond 2020 R2 per AVEVA Security Bulletin AVEVA-2023-001.
- If patching is delayed, restrict network access to the secure gateway to trusted hosts and remove direct internet exposure.
- Place the gateway behind an authenticating reverse proxy or VPN so unauthenticated requests cannot reach it.
- Review gateway file system permissions and run the service with least privilege to limit what a traversal can read.
- Monitor vendor advisory and CISA ICS advisory ICSA-22-342-02 for updated guidance.
Detection
- Inspect web server and gateway logs for traversal sequences such as ../, ..%2f or encoded variants in request paths.
- Alert on requests returning files outside expected web content paths or unusual file extensions from the gateway.
- Baseline normal gateway request patterns and flag anomalous file-read requests from unfamiliar source IPs.
- Monitor for scanning activity against the gateway port from external or untrusted networks.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2022-23854 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-23854), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
