PT-2019-15300 · Ge · Relion 670 Series

Published 2019-11-27 · Updated 2023-05-16 · CVE-2019-18253

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Relion 670 Series versions 1p1r26 through 2.1.0.1 Relion 670 Series versions prior to 1p1r26

Description An attacker could use specially crafted paths in a specific request to read or delete files from Relion 670 Series outside the intended directory.

Recommendations For Relion 670 Series versions 1p1r26 through 2.1.0.1, consider restricting access to sensitive files and directories until a patch is available. For Relion 670 Series versions prior to 1p1r26, consider updating to a version that is not vulnerable, if available. As a temporary workaround, consider disabling the specific request that allows file reading or deletion outside the intended directory until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-18253

Affected Products

Relion 670 Series

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-18253 · Security Note
• https://osv.dev/vulnerability/CVE-2019-18253 · Vendor Advisory
• https://us-cert.gov/ics/advisories/icsa-19-330-01 · Note
• https://t.me/cvenotify/50609 · Telegram Post