PT-2023-20691 · Propius · Machineselector

Published 2023-03-14 · Updated 2025-02-27 · CVE-2023-26511

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Propius MachineSelector versions 6.6.0 through 6.6.1

Description A Hard Coded Admin Credentials issue in the Web-UI Admin Panel allows remote attackers to gain access to the admin panel Propiusadmin.php, which allows taking control of the affected system.

Recommendations For versions 6.6.0 and 6.6.1, consider disabling access to the Propiusadmin.php admin panel until a patch is available. Restrict access to the Web-UI Admin Panel to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2023-26511

Affected Products

Machineselector

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-26511 · Security Note
• https://osv.dev/vulnerability/CVE-2023-26511 · Vendor Advisory
• https://propius.de/ms_security.html · Vendor Advisory
• https://t.me/cvenotify/46535 · Telegram Post
• https://t.me/cibsecurity/60033 · Telegram Post
• https://t.me/cvenotify/112706 · Telegram Post
• https://t.me/cvenotify/46168 · Telegram Post