PT-2023-32138 · Unknown · Shenzhen Reachfar

Joel Serna Moreno · Published 2023-10-10 · Updated 2023-12-19 · CVE-2023-5499

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Shenzhen Reachfar version v28

Description The issue allows a remote attacker to retrieve all the week's logs stored in the 'log2' directory, potentially exposing sensitive information such as remembered wifi networks, sent messages, SOS device locations, and device configurations.

Recommendations For Shenzhen Reachfar version v28, consider restricting access to the 'log2' directory as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2023-5499

Affected Products

Shenzhen Reachfar

References · 6

• https://osv.dev/vulnerability/CVE-2023-5499 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5499 · Security Note
• https://t.me/cvenotify/64149 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/shenzhen-reachfar-v28-information-exposure · Note
• https://t.me/cvenotify/59661 · Telegram Post
• https://t.me/cibsecurity/71944 · Telegram Post