PT-2023-2807 · Siemens · Scalance Lpe9403

Published 2023-05-09 · Updated 2023-05-15 · CVE-2023-27409

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SCALANCE LPE9403 versions prior to V2.1

Description A path traversal vulnerability was found in the deviceinfo binary via the mac parameter. This could allow an authenticated attacker with access to the SSH interface on the affected device to read the contents of any file named address. The vulnerability is related to incorrect restriction of directory path names with limited access, which may allow a remote attacker to gain unauthorized access to protected information.

Recommendations For SCALANCE LPE9403 versions prior to V2.1, update to version V2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the deviceinfo binary and the mac parameter to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2023-02732

CVE-2023-27409

Affected Products

Scalance Lpe9403

References · 5

• https://cert-portal.siemens.com/productcert/pdf/ssa-325383.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27409 · Security Note
• https://bdu.fstec.ru/vul/2023-02732 · Security Note
• https://osv.dev/vulnerability/CVE-2023-27409 · Vendor Advisory
• https://t.me/cibsecurity/63609 · Telegram Post