PT-2023-2628 · Siemens · Scalance Lpe9403

Publicado 2023-05-09 · Atualizado 2023-05-15 · CVE-2023-27407

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SCALANCE LPE9403 versions prior to V2.1

Description A vulnerability has been identified in the web-based management of the affected device, which does not properly validate user input, making it susceptible to command injection. This could allow an authenticated remote attacker to access the underlying operating system as the root user.

Recommendations For versions prior to V2.1, update to version V2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the web-based management interface to minimize the risk of exploitation. Avoid using the vulnerable web-based management interface until the issue is resolved.

Correção

OS Command Injection

Command Injection

Enumeração de Fraquezas

CWE-78

CWE-77

Identificadores relacionados

BDU:2023-02468

CVE-2023-27407

Produtos afetados

Scalance Lpe9403

Referências · 5

• https://cert-portal.siemens.com/productcert/pdf/ssa-325383.pdf · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-27407 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-27407 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-02468 · Nota de Segurança
• https://t.me/cibsecurity/63596 · Publicação no Telegram