PT-2023-19786 · Vinga · Vinga Wr-Ac1200

Yinfei6 · Published 2023-04-26 · Updated 2024-05-02 · CVE-2023-24796

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vinga WR-AC1200 versions 81.102.1.4370 and before

Description A password vulnerability allows a remote attacker to execute arbitrary code via the password parameter at the "/goform/sysTools" and "/adm/systools.asp" endpoints. This issue has been identified in scans probing for vulnerable routers.

Recommendations For Vinga WR-AC1200 versions 81.102.1.4370 and before, consider disabling access to the "/goform/sysTools" and "/adm/systools.asp" endpoints until a patch is available. As a temporary workaround, restrict the use of the password parameter in these endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2023-24796

Affected Products

Vinga Wr-Ac1200

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-24796 · Security Note
• https://osv.dev/vulnerability/CVE-2023-24796 · Vendor Advisory
• https://twitter.com/IT_securitynews/status/1786101526177419492 · Twitter Post
• https://t.me/cvenotify/49107 · Telegram Post
• https://t.me/cibsecurity/62890 · Telegram Post
• https://twitter.com/PoseidonTPA/status/1786111449838018732 · Twitter Post
• https://twitter.com/sans_isc/status/1786096072340680969 · Twitter Post
• https://t.me/cvenotify/49101 · Telegram Post
• https://gist.github.com/yinfei6/3664387cb5b66b68c7eff4bfdb51b2d6 · Note