PT-2023-32138 · Unknown · Shenzhen Reachfar

Joel Serna Moreno · Publicado 2023-10-10 · Atualizado 2023-12-19 · CVE-2023-5499

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Shenzhen Reachfar version v28

Description The issue allows a remote attacker to retrieve all the week's logs stored in the 'log2' directory, potentially exposing sensitive information such as remembered wifi networks, sent messages, SOS device locations, and device configurations.

Recommendations For Shenzhen Reachfar version v28, consider restricting access to the 'log2' directory as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

CVE-2023-5499

Produtos afetados

Shenzhen Reachfar

Referências · 6

• https://osv.dev/vulnerability/CVE-2023-5499 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-5499 · Nota de Segurança
• https://t.me/cvenotify/64149 · Publicação no Telegram
• https://incibe.es/en/incibe-cert/notices/aviso/shenzhen-reachfar-v28-information-exposure · Nota
• https://t.me/cvenotify/59661 · Publicação no Telegram
• https://t.me/cibsecurity/71944 · Publicação no Telegram