PT-2023-16280 · Econolite · Econolite Eos

Rustam Amin · Publicado 2023-01-26 · Atualizado 2023-06-20 · CVE-2023-0451

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Econolite EOS versions prior to 3.2.23

Description The issue concerns a lack of password requirement for gaining "READONLY" access to log files and certain database and configuration files. One such file contains tables with MD5 hashes and usernames for all defined users in the control software, including administrators and technicians.

Recommendations For Econolite EOS versions prior to 3.2.23, update to version 3.2.23 or later to resolve the issue. As a temporary workaround, consider restricting access to the log files and certain database and configuration files to minimize the risk of exploitation.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2023-0451

Produtos afetados

Econolite Eos

Referências · 4

• https://t.me/cvenotify/43690 · Publicação no Telegram
• https://t.me/cvenotify/52704 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-0451 · Nota de Segurança
• https://cisa.gov/uscert/ics/advisories/icsa-23-026-02 · Nota