PT-2023-8203 · Ami · Ami Aptiov

Published 2023-12-04 · Updated 2024-01-05 · CVE-2023-39538

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AMI AptioV (affected versions not specified)

Description The issue is related to a vulnerability in the BIOS of AMI AptioV, specifically in the handling of BMP Logo files. This vulnerability allows a user with local access to upload a BMP Logo file of a dangerous type without restrictions. A successful exploitation of this issue may result in a loss of confidentiality, integrity, and/or availability of protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-20

CWE-434

Related Identifiers

BDU:2024-00196

CVE-2023-39538

Affected Products

Ami Aptiov

References · 8

• https://bdu.fstec.ru/vul/2024-00196 · Security Note
• https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023009.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39538 · Security Note
• https://t.me/cvenotify/62532 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1732616324545991021 · Twitter Post
• https://t.me/cvenotify/66422 · Telegram Post
• https://twitter.com/fletch_ai/status/1731872777336951085 · Twitter Post
• https://security.netapp.com/advisory/ntap-20240105-0003 · Note