PT-2023-26821 · Senec · Senec Storage Box

Ph0S[4] + 1 · Published 2023-12-07 · Updated 2023-12-14 · CVE-2023-39167

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SENEC Storage Box versions V1, V2, and V3

Description An unauthenticated remote attacker can obtain the devices' logfiles that contain sensitive data.

Recommendations For versions V1, V2, and V3, restrict access to the logfiles to prevent unauthorized disclosure of sensitive data. As a temporary workaround, consider disabling remote access to the devices until a patch is available. Avoid using the devices' logfiles in sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-39167

Affected Products

Senec Storage Box

References · 7

• 🔥 https://seclists.org/fulldisclosure/2023/Nov/5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-39167 · Security Note
• https://osv.dev/vulnerability/CVE-2023-39167 · Vendor Advisory
• https://twitter.com/cracbot/status/1733259747426455600 · Twitter Post
• http://seclists.org/fulldisclosure/2023/Nov/10 · Note
• https://twitter.com/CVEnew/status/1732769742430056836 · Twitter Post
• https://t.me/cvenotify/63694 · Telegram Post