PT-2023-2029 · Hitachi Energy · Sdm600

Publicado 2023-03-28 · Atualizado 2023-04-04 · CVE-2022-3682

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hitachi Energy System Data Manager SDM600 versions prior to 1.2 FP3 HF4 (Build Nr. 1.2.23000.291)

Description A vulnerability exists in the SDM600 file permission validation, allowing an attacker to exploit the system by uploading a specially crafted message, potentially resulting in arbitrary code execution. This issue affects all SDM600 versions prior to version 1.2 FP3 HF4.

Recommendations For SDM600 versions prior to 1.2 FP3 HF4 (Build Nr. 1.2.23000.291), update to version 1.2 FP3 HF4 or later to resolve the issue. At the moment, there is no information about other versions that contain a fix for this vulnerability.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

BDU:2023-01741

CVE-2022-3682

Produtos afetados

Sdm600

Referências · 7

• https://t.me/cibsecurity/60882 · Publicação no Telegram
• https://t.me/cvenotify/46983 · Publicação no Telegram
• https://search.abb.com/library/Download.aspx?DocumentID=8DBD000138&LanguageCode=en&DocumentPartId=&Action=Launch · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-01741 · Nota de Segurança
• https://search.abb.com/library/Download.aspx?DocumentID=8DBD000138&LanguageCode=en&DocumentPartId=&Action=Launch · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-3682 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-3682 · Aviso do Fabricante