IOServer OPC Server Multiple Vulnerabilities

An attacker could read, write, or delete arbitrary files on a system running the OPC Server, potentially compromising configuration files, historical data, or other critical files that OPC clients depend on for process automation and monitoring.

Water utilities and electric utilities that use IOServer OPC Server for SCADA integration and process monitoring. This affects any facility using OPC for real-time communication between engineering workstations, historians, and control systems. Particular concern for organizations running legacy automation environments where the OPC Server acts as a central data broker.

An attacker with network access to the OPC Server could craft malicious requests using path traversal sequences (such as ../ or encoded variants) to access files outside the intended directory structure. If the OPC Server handles file operations without proper input validation, the attacker could retrieve sensitive files or modify them to disrupt operations.