PT-2023-29997 · Loytec Electronics Gmbh · Linx-151+1

Chizuru Toyama · Publicado 2023-11-30 · Atualizado 2024-09-20 · CVE-2023-46388

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions)

Description The issue allows remote attackers to disclose smtp client account credentials and bypass email authentication due to insecure permissions via the dpal config.zml file.

Recommendations For LINX-212 and LINX-151 devices, restrict access to the dpal config.zml file to prevent remote attackers from disclosing smtp client account credentials and bypassing email authentication. As a temporary workaround, consider restricting the use of the smtp client until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-312

Identificadores relacionados

CVE-2023-46388

Produtos afetados

Linx-151

Linx-212

Referências · 9

• http://packetstormsecurity.com/files/175952/Loytec-L-INX-Automation-Servers-Information-Disclosure-Cleartext-Secrets.html · Nota
• https://t.me/cvenotify/63651 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-46388 · Nota de Segurança
• https://t.me/cvenotify/62574 · Publicação no Telegram
• https://cisa.gov/news-events/ics-advisories/icsa-24-247-01 · Nota
• https://txone.com/blog/ten-unpatched-vulnerabilities-in-building-automation-products-identified-by-txone-networks · Nota
• http://seclists.org/fulldisclosure/2023/Nov/7 · Nota
• https://osv.dev/vulnerability/CVE-2023-46388 · Aviso do Fabricante
• https://t.me/cvenotify/95484 · Publicação no Telegram