PT-2023-21416 · Conprosys · Conprosys M2M Controller Configurable Type+3

Peishilong

·

Published

2023-04-11

·

Updated

2025-02-10

·

CVE-2023-27917

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions CONPROSYS M2M Gateway versions 3.7.10 and earlier CONPROSYS M2M Controller Integrated Type versions 3.7.6 and earlier CONPROSYS M2M Controller Configurable Type versions 3.8.8 and earlier
Description A remote authenticated attacker who can access the Network Maintenance page can execute arbitrary OS commands with root privilege due to an OS command injection vulnerability in CONPROSYS IoT Gateway products.
Recommendations For CONPROSYS M2M Gateway versions 3.7.10 and earlier, update to a version later than 3.7.10 to resolve the issue. For CONPROSYS M2M Controller Integrated Type versions 3.7.6 and earlier, update to a version later than 3.7.6 to resolve the issue. For CONPROSYS M2M Controller Configurable Type versions 3.8.8 and earlier, update to a version later than 3.8.8 to resolve the issue. As a temporary workaround, consider restricting access to the Network Maintenance page to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2023-27917

Affected Products

Conprosys Iot Gateway
Conprosys M2M Controller Configurable Type
Conprosys M2M Controller Integrated Type
Conprosys M2M Gateway