PT-2023-2807 · Siemens · Scalance Lpe9403

Publicado 2023-05-09 · Atualizado 2023-05-15 · CVE-2023-27409

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Baixa

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SCALANCE LPE9403 versions prior to V2.1

Description A path traversal vulnerability was found in the deviceinfo binary via the mac parameter. This could allow an authenticated attacker with access to the SSH interface on the affected device to read the contents of any file named address. The vulnerability is related to incorrect restriction of directory path names with limited access, which may allow a remote attacker to gain unauthorized access to protected information.

Recommendations For SCALANCE LPE9403 versions prior to V2.1, update to version V2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the deviceinfo binary and the mac parameter to minimize the risk of exploitation.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2023-02732

CVE-2023-27409

Produtos afetados

Scalance Lpe9403

Referências · 5

• https://cert-portal.siemens.com/productcert/pdf/ssa-325383.pdf · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-27409 · Nota de Segurança
• https://t.me/cibsecurity/63609 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-02732 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-27409 · Aviso do Fabricante