PT-2023-19054 · Unknown · Conprosys M2M Controller Integrated Type+2

Published 2023-04-11 · Updated 2025-02-11 · CVE-2023-23575

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions CONPROSYS M2M Gateway versions 3.7.10 and earlier CONPROSYS M2M Controller Integrated Type versions 3.7.6 and earlier CONPROSYS M2M Controller Configurable Type versions 3.8.8 and earlier

Description An improper access control issue allows a remote authenticated attacker to bypass access restrictions and access the Network Maintenance page, potentially obtaining network information.

Recommendations For CONPROSYS M2M Gateway versions 3.7.10 and earlier, update to a version later than 3.7.10. For CONPROSYS M2M Controller Integrated Type versions 3.7.6 and earlier, update to a version later than 3.7.6. For CONPROSYS M2M Controller Configurable Type versions 3.8.8 and earlier, update to a version later than 3.8.8.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2023-23575

Affected Products

Conprosys M2M Controller Configurable Type

Conprosys M2M Controller Integrated Type

Conprosys M2M Gateway

References · 9

• https://osv.dev/vulnerability/CVE-2023-23575 · Vendor Advisory
• https://contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_cps_230317_en.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23575 · Security Note
• https://jvn.jp/en/vu/JVNVU96198617 · Note
• https://t.me/cvenotify/110857 · Telegram Post
• https://contec.com/download/donwload-list/?itemid=f832c526-dcf6-4976-85aa-f536c15a8120#firmware · Note
• https://t.me/cvenotify/48518 · Telegram Post
• https://contec.com/download/donwload-list/?itemid=a1b33f0d-d32b-4549-9741-613cd37d5528#firmware · Note
• https://contec.com/download/donwload-list/?itemid=a054b3eb-da97-40d0-9598-d7f5ff4239ec#firmware · Note