PT-2023-15228 · Generex · Generex Ups Cs141

CVE-2022-47188 · Publicado 2023-03-31 · Atualizado 2023-04-06

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Generex UPS CS141 versions prior to 2.06

Description The issue allows an attacker to read arbitrary files, potentially leading to sensitive information disclosure. By utilizing default credentials, an attacker can upload a backup file that contains a symlink to a sensitive path, such as /etc/shadow, thereby obtaining its content.

Recommendations For versions prior to 2.06, update to version 2.06 or later to resolve the issue. As a temporary workaround, consider changing the default credentials to prevent unauthorized access. Restrict the ability to upload backup files or limit access to sensitive paths to minimize the risk of exploitation.

Correção

Link Following

RCE

Enumeração de Fraquezas

CWE-59

CWE-20

Identificadores relacionados

CVE-2022-47188

Produtos afetados

Generex Ups Cs141

Referências · 7

• https://generex.de/support/changelogs/cs141/2-12 · Aviso do Fabricante
• https://t.me/cvenotify/47305 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-47188 · Aviso do Fabricante
• https://generex.de/support/changelogs/cs141/page:2 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-47188 · Nota de Segurança
• https://t.me/cvenotify/47316 · Publicação no Telegram
• https://incibe-cert.es/en/early-warning/ics-advisories/update-03032023-multiple-vulnerabilities-generex-ups-cs141 · Nota