|CVSS SCORE||6.8, (AV:L/AC:L/Au:S/C:C/I:C/A:C)|
The specific flaw exists within the handling of the system configuration. The web administration account is set up with the ability to sudo without a password. An attacker can leverage this vulnerability to execute arbitrary code under the context of root.
03/29/2016 - ZDI disclosed the vulnerability reports to ICS-CERT (with an expected 'due date' of 07/27/16).
Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the service to trusted machines. Only the clients and servers that have a legitimate procedural relationship with the service should be permitted to communicate with it. This could be accomplished in a number of ways, most notably with firewall rules/whitelisting. These features are available in the native Windows Firewall, as described in http://technet.microsoft.com/en-us/library/cc725770%28WS.10%29.aspx and numerous other Microsoft Knowledge Base articles.