PT-2023-5704 · Weintek · Weintek Weincloud

Hank Chen · Published 2023-07-18 · Updated 2023-07-26 · CVE-2023-34429

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Weintek Weincloud version 0.13.6

Description The issue is related to the incorrect handling of construction elements in the Weincloud cloud platform for managing industrial devices. An attacker could exploit this by sending a forged JWT token, potentially causing a denial-of-service condition for Weincloud. This could be achieved by remotely sending the forged token.

Recommendations For Weintek Weincloud version 0.13.6, consider disabling the handling of JWT tokens as a temporary workaround until a patch is available. Restrict access to the Weincloud platform to minimize the risk of exploitation. Avoid using the JWT token in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-237

Related Identifiers

BDU:2023-06374

CVE-2023-34429

Affected Products

Weintek Weincloud

References · 8

• https://osv.dev/vulnerability/CVE-2023-34429 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06374 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-34429 · Security Note
• https://t.me/cibsecurity/67022 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2023071905 · Note
• https://cisa.gov/news-events/ics-advisories/icsa-23-199-04 · Note
• https://t.me/cvenotify/54688 · Telegram Post
• https://t.me/cvenotify/55205 · Telegram Post