PT-2023-4886 · Siemens · Ruggedcom Crossbow

Publicado 2023-08-08 · Atualizado 2023-08-10 · CVE-2023-37373

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions RUGGEDCOM CROSSBOW versions prior to V5.4

Description A vulnerability has been identified that allows unauthenticated remote attackers to write arbitrary files to the affected application's file system due to the lack of authentication for a critical function. This issue is related to the secure access control system of RUGGEDCOM CROSSBOW.

Recommendations For versions prior to V5.4, update to version V5.4 or later to resolve the issue. As a temporary workaround, consider restricting access to critical functions that accept file write messages to prevent exploitation.

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

BDU:2023-05377

CVE-2023-37373

Produtos afetados

Ruggedcom Crossbow

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-37373 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-37373 · Aviso do Fabricante
• https://t.me/cibsecurity/67957 · Publicação no Telegram
• https://cert-portal.siemens.com/productcert/pdf/ssa-472630.pdf · Aviso do Fabricante
• https://cybersecurity-help.cz/vdb/SB2023081011 · Nota
• https://bdu.fstec.ru/vul/2023-05377 · Nota de Segurança