PT-2023-26390 · Rigol · Rigol Mso5000

Kriive · Publicado 2023-07-16 · Atualizado 2024-10-30 · CVE-2023-38379

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions RIGOL MSO5000 digital oscilloscope version 00.01.03.00.03

Description The issue allows remote attackers to change the admin password via a zero-length password to the "webcontrol changepwd.cgi" application. This means the entered password only needs to match the first zero characters of the saved password.

Recommendations For RIGOL MSO5000 digital oscilloscope version 00.01.03.00.03, consider disabling access to the webcontrol changepwd.cgi application until a patch is available. Restrict access to the admin interface to minimize the risk of exploitation. Avoid using the default admin password and ensure that all passwords are complex and not easily guessable.

Exploit

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2023-38379

Produtos afetados

Rigol Mso5000

Referências · 6

• 🔥 https://tortel.li/post/insecure-scope · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-38379 · Nota de Segurança
• https://t.me/cvenotify/100051 · Publicação no Telegram
• https://t.me/cvenotify/54464 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-38379 · Aviso do Fabricante
• https://news.ycombinator.com/item?id=36745664 · Nota