PT-2023-15228 · Generex · Generex Ups Cs141

Published 2023-03-31 · Updated 2023-04-06 · CVE-2022-47188

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Generex UPS CS141 versions prior to 2.06

Description The issue allows an attacker to read arbitrary files, potentially leading to sensitive information disclosure. By utilizing default credentials, an attacker can upload a backup file that contains a symlink to a sensitive path, such as /etc/shadow, thereby obtaining its content.

Recommendations For versions prior to 2.06, update to version 2.06 or later to resolve the issue. As a temporary workaround, consider changing the default credentials to prevent unauthorized access. Restrict the ability to upload backup files or limit access to sensitive paths to minimize the risk of exploitation.

Fix

Link Following

RCE

Weakness Enumeration

CWE-59

CWE-20

Related Identifiers

CVE-2022-47188

Affected Products

Generex Ups Cs141

References · 7

• https://generex.de/support/changelogs/cs141/2-12 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-47188 · Vendor Advisory
• https://generex.de/support/changelogs/cs141/page:2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-47188 · Security Note
• https://t.me/cvenotify/47305 · Telegram Post
• https://t.me/cvenotify/47316 · Telegram Post
• https://incibe-cert.es/en/early-warning/ics-advisories/update-03032023-multiple-vulnerabilities-generex-ups-cs141 · Note