PT-2023-28635 · Frauscher Sensortechnik Gmbh · Fds101

Published 2023-09-20 · Updated 2023-09-22 · CVE-2023-4291

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi versions 1.4.24 and all previous versions

Description The issue is a remote code execution (RCE) vulnerability that can be exploited via manipulated parameters of the web interface without authentication, potentially leading to a full compromise of the FDS101 device.

Recommendations For versions 1.4.24 and all previous versions, consider disabling access to the web interface until a patch is available to prevent exploitation of the RCE vulnerability. Restrict access to the device to minimize the risk of compromise. Avoid using manipulated parameters in the web interface to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-4291

Affected Products

Fds101

References · 9

• https://osv.dev/vulnerability/CVE-2023-4291 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4291 · Security Note
• https://cert.vde.com/en/advisories/VDE-2023-038 · Note
• https://t.me/cvenotify/58417 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1704807910692544799 · Twitter Post
• https://twitter.com/cracbot/status/1705099649252770037 · Twitter Post
• https://t.me/cibsecurity/70869 · Telegram Post
• https://t.me/cvenotify/58275 · Telegram Post
• https://twitter.com/CVEnew/status/1704747148036976886 · Twitter Post