PT-2023-24323 · Unknown · Connected Io

Published 2023-08-04 · Updated 2023-08-08 · CVE-2023-33374

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Connected IO versions 2.1.0 and prior

Description The issue allows attackers to execute arbitrary OS commands on devices, resulting in arbitrary remote command execution. This is due to a command in the communication protocol that enables the management platform to specify OS commands for devices to execute.

Recommendations For versions 2.1.0 and prior, consider disabling the vulnerable command in the communication protocol as a temporary workaround until a patch is available. Restrict access to the management platform to minimize the risk of exploitation. Avoid using the affected communication protocol until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2023-33374

Affected Products

Connected Io

References · 5

• https://osv.dev/vulnerability/CVE-2023-33374 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33374 · Security Note
• https://connectedio.com/products/routers · Note
• https://claroty.com/team82/disclosure-dashboard/cve-2023-33374 · Note
• https://t.me/cibsecurity/67793 · Telegram Post