PT-2023-21091 · Conprosys · Conprosys M2M Controller Integrated Type+3

Peishilong

·

Published

2023-04-11

·

Updated

2025-02-10

·

CVE-2023-27389

CVSS v3.1

7.2

High

VectorAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions CONPROSYS M2M Gateway versions 3.7.10 and earlier CONPROSYS M2M Controller Integrated Type versions 3.7.6 and earlier CONPROSYS M2M Controller Configurable Type versions 3.8.8 and earlier
Description Inadequate encryption strength vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker with an administrative privilege to apply a specially crafted Firmware update file, alter the information, cause a denial-of-service (DoS) condition, and/or execute arbitrary code.
Recommendations For CONPROSYS M2M Gateway versions 3.7.10 and earlier, update the firmware to a version later than 3.7.10. For CONPROSYS M2M Controller Integrated Type versions 3.7.6 and earlier, update the firmware to a version later than 3.7.6. For CONPROSYS M2M Controller Configurable Type versions 3.8.8 and earlier, update the firmware to a version later than 3.8.8. As a temporary workaround, consider restricting access to the firmware update feature to minimize the risk of exploitation.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2023-27389

Affected Products

Conprosys Iot Gateway
Conprosys M2M Controller Configurable Type
Conprosys M2M Controller Integrated Type
Conprosys M2M Gateway