PT-2023-3107 · Hitron · Hitron Coda-5310

Zet · Published 2023-05-02 · Updated 2023-06-10 · CVE-2022-47616

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Hitron CODA-5310 (affected versions not specified)

Description The issue exists due to insufficient measures to neutralize special elements used in the operating system command. A remote attacker, authenticated as an administrator, can exploit this to execute arbitrary system commands, manipulate the system, or disrupt the service. This can be achieved through the management page by performing command injection attacks, specifically targeting the connection test function with insufficient filtering for specific parameters.

Recommendations For Hitron CODA-5310, restrict access to the management page and the connection test function to minimize the risk of exploitation. As a temporary workaround, consider disabling the connection test function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-03199

CVE-2022-47616

Affected Products

Hitron Coda-5310

References · 6

• https://bdu.fstec.ru/vul/2023-03199 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-47616 · Security Note
• https://t.me/cvenotify/51605 · Telegram Post
• https://twcert.org.tw/tw/cp-132-7082-373d5-1.html · Note
• https://vuldb.com/ru/?id.230548 · Note
• https://t.me/cvenotify/52093 · Telegram Post