PT-2023-21416 · Conprosys · Conprosys M2M Controller Configurable Type+3

Peishilong

·

Publicado

2023-04-11

·

Atualizado

2025-02-10

·

CVE-2023-27917

CVSS v3.1

8.8

Alta

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions CONPROSYS M2M Gateway versions 3.7.10 and earlier CONPROSYS M2M Controller Integrated Type versions 3.7.6 and earlier CONPROSYS M2M Controller Configurable Type versions 3.8.8 and earlier
Description A remote authenticated attacker who can access the Network Maintenance page can execute arbitrary OS commands with root privilege due to an OS command injection vulnerability in CONPROSYS IoT Gateway products.
Recommendations For CONPROSYS M2M Gateway versions 3.7.10 and earlier, update to a version later than 3.7.10 to resolve the issue. For CONPROSYS M2M Controller Integrated Type versions 3.7.6 and earlier, update to a version later than 3.7.6 to resolve the issue. For CONPROSYS M2M Controller Configurable Type versions 3.8.8 and earlier, update to a version later than 3.8.8 to resolve the issue. As a temporary workaround, consider restricting access to the Network Maintenance page to minimize the risk of exploitation.

Correção

OS Command Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2023-27917

Produtos afetados

Conprosys Iot Gateway
Conprosys M2M Controller Configurable Type
Conprosys M2M Controller Integrated Type
Conprosys M2M Gateway