PT-2023-26821 · Senec · Senec Storage Box

Ph0S[4] + 1 · Publicado 2023-12-07 · Atualizado 2023-12-14 · CVE-2023-39167

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SENEC Storage Box versions V1, V2, and V3

Description An unauthenticated remote attacker can obtain the devices' logfiles that contain sensitive data.

Recommendations For versions V1, V2, and V3, restrict access to the logfiles to prevent unauthorized disclosure of sensitive data. As a temporary workaround, consider disabling remote access to the devices until a patch is available. Avoid using the devices' logfiles in sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2023-39167

Produtos afetados

Senec Storage Box

Referências · 7

• 🔥 https://seclists.org/fulldisclosure/2023/Nov/5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-39167 · Nota de Segurança
• https://twitter.com/cracbot/status/1733259747426455600 · Publicação no Twitter
• http://seclists.org/fulldisclosure/2023/Nov/10 · Nota
• https://twitter.com/CVEnew/status/1732769742430056836 · Publicação no Twitter
• https://t.me/cvenotify/63694 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-39167 · Aviso do Fabricante