PT-2023-1650 · Unknown · Sipass Integrated Ac5102+1

Publicado 2023-02-14 · Atualizado 2023-02-22 · CVE-2022-31808

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SiPass integrated AC5102 (ACC-G2) versions prior to V2.85.44 SiPass integrated ACC-AP versions prior to V2.85.43

Description A vulnerability has been identified in the telnet command line interface of the affected devices, where they improperly sanitize user input. This could allow an authenticated user to escalate privileges by injecting arbitrary commands that are executed with root privileges. The issue is related to errors in processing input data, which can be exploited to execute arbitrary code in the context of the root user.

Recommendations For SiPass integrated AC5102 (ACC-G2) versions prior to V2.85.44, update to version V2.85.44 or later to resolve the issue. For SiPass integrated ACC-AP versions prior to V2.85.43, update to version V2.85.43 or later to resolve the issue. As a temporary workaround, consider restricting access to the telnet command line interface until a patch is available.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2023-01187

CVE-2022-31808

Produtos afetados

Sipass Integrated Ac5102

Sipass Integrated Acc-Ap

Referências · 4

• https://osv.dev/vulnerability/CVE-2022-31808 · Aviso do Fabricante
• https://cert-portal.siemens.com/productcert/pdf/ssa-658793.pdf · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-31808 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-01187 · Nota de Segurança