PT-2023-14126 · Siretta · Siretta Quartz-Gold

Francesco Benvenuto · Published 2023-01-26 · Updated 2023-02-06 · CVE-2022-42492

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Siretta QUARTZ-GOLD version G5.0.1.5-210720-141020

Description Several OS command injection issues exist in the m2m binary, allowing arbitrary command execution through a specially-crafted network request. An attacker can trigger these issues by sending a network request, specifically through the m2m's DOWNLOAD AD command.

Recommendations For Siretta QUARTZ-GOLD version G5.0.1.5-210720-141020, as a temporary workaround, consider disabling the DOWNLOAD AD command in the m2m binary until a patch is available. Restrict access to the m2m binary to minimize the risk of exploitation. Avoid using the DOWNLOAD AD command in the affected m2m binary until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-42492

Affected Products

Siretta Quartz-Gold

References · 4

• https://osv.dev/vulnerability/CVE-2022-42492 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-42492 · Security Note
• https://talosintelligence.com/vulnerability_reports/TALOS-2022-1640 · Note
• https://t.me/cvenotify/43698 · Telegram Post