PT-2023-25654 · Prolion · Prolion Cryptospike

Published 2023-12-11 · Updated 2023-12-14 · CVE-2023-36650

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ProLion CryptoSpike version 3.0.15P2

Description A missing integrity check in the update system allows attackers to execute OS commands as the root Linux user on the host system via forged update packages.

Recommendations For ProLion CryptoSpike version 3.0.15P2, consider disabling the update system until a patch is available to prevent exploitation. Restrict access to the host system to minimize the risk of attackers executing OS commands as the root Linux user. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-354

Related Identifiers

CVE-2023-36650

Affected Products

Prolion Cryptospike

References · 6

• 🔥 https://cvcn.gov.it/cvcn/cve/CVE-2023-36650 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-36650 · Security Note
• https://osv.dev/vulnerability/CVE-2023-36650 · Vendor Advisory
• https://t.me/cvenotify/63604 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1734482841189187950 · Twitter Post
• https://twitter.com/CVEnew/status/1734379222523674667 · Twitter Post