OAS Engine Deep Dive: Abusing low-impact vulnerabilities to escalate privileges

Cisco Talos disclosed eight vulnerabilities in Open Automation Software's OAS Engine (patched in Version 19) that together allow attackers to bypass authentication (default config or replaying/stolen U_EP tokens), enumerate files, overwrite arbitrary files, and abuse unsanitized usernames to inject SSH public keys into the running configuration. The report includes protobuf protocol details for the OAS configuration protocol, step-by-step exploitation guidance showing how an attacker could gain SSH access as the OAS service user, and mitigation advice to upgrade and apply Snort rules to detect exploitation attempts.