Claroty Secure Remote Access Site

An attacker with local access to the SRA Site server could read the central configuration file and extract sensitive information that would normally be restricted. This could expose credentials or operational settings needed to access remote systems managed through SRA.

Organizations that operate Claroty Secure Remote Access Site for managing remote access to industrial control systems—particularly in utilities, manufacturing, and critical infrastructure—should assess whether they run affected versions. This is relevant to any IT or control systems team managing remote operator access or emergency response connections to SCADA systems.

An attacker must first gain local (shell) access to the Linux system hosting SRA Site—for example through a compromised admin account, weak SSH credentials, or physical access. Once local access is obtained, the attacker can bypass file permission controls to read the central configuration file containing sensitive data.