PT-2023-29997 · Loytec Electronics Gmbh · Linx-151+1

Chizuru Toyama · Published 2023-11-30 · Updated 2024-09-20 · CVE-2023-46388

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions)

Description The issue allows remote attackers to disclose smtp client account credentials and bypass email authentication due to insecure permissions via the dpal config.zml file.

Recommendations For LINX-212 and LINX-151 devices, restrict access to the dpal config.zml file to prevent remote attackers from disclosing smtp client account credentials and bypassing email authentication. As a temporary workaround, consider restricting the use of the smtp client until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2023-46388

Affected Products

Linx-151

Linx-212

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-46388 · Security Note
• https://osv.dev/vulnerability/CVE-2023-46388 · Vendor Advisory
• http://packetstormsecurity.com/files/175952/Loytec-L-INX-Automation-Servers-Information-Disclosure-Cleartext-Secrets.html · Note
• https://t.me/cvenotify/63651 · Telegram Post
• https://t.me/cvenotify/62574 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-24-247-01 · Note
• https://txone.com/blog/ten-unpatched-vulnerabilities-in-building-automation-products-identified-by-txone-networks · Note
• http://seclists.org/fulldisclosure/2023/Nov/7 · Note
• https://t.me/cvenotify/95484 · Telegram Post