PT-2023-1650 · Unknown · Sipass Integrated Ac5102+1

Published 2023-02-14 · Updated 2023-02-22 · CVE-2022-31808

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SiPass integrated AC5102 (ACC-G2) versions prior to V2.85.44 SiPass integrated ACC-AP versions prior to V2.85.43

Description A vulnerability has been identified in the telnet command line interface of the affected devices, where they improperly sanitize user input. This could allow an authenticated user to escalate privileges by injecting arbitrary commands that are executed with root privileges. The issue is related to errors in processing input data, which can be exploited to execute arbitrary code in the context of the root user.

Recommendations For SiPass integrated AC5102 (ACC-G2) versions prior to V2.85.44, update to version V2.85.44 or later to resolve the issue. For SiPass integrated ACC-AP versions prior to V2.85.43, update to version V2.85.43 or later to resolve the issue. As a temporary workaround, consider restricting access to the telnet command line interface until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-01187

CVE-2022-31808

Affected Products

Sipass Integrated Ac5102

Sipass Integrated Acc-Ap

References · 4

• https://osv.dev/vulnerability/CVE-2022-31808 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-658793.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31808 · Security Note
• https://bdu.fstec.ru/vul/2023-01187 · Security Note