PT-2024-15776 · Byzoro · Byzoro Smart S150 Management Platform

Rollingchair · Published 2024-01-19 · Updated 2024-10-21 · CVE-2024-0716

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Byzoro Smart S150 Management Platform version V31R02B15

Description A vulnerability has been found in the Byzoro Smart S150 Management Platform, affecting an unknown part of the file /log/download.php of the component Backup File Handler. This leads to information disclosure and can be initiated remotely. The complexity of an attack is rather high, and the exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.

Recommendations For version V31R02B15, as a temporary workaround, consider restricting access to the /log/download.php file until a patch is available. Additionally, restrict the use of the Backup File Handler component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Insertion into Log File

Weakness Enumeration

CWE-200

CWE-532

Related Identifiers

CVE-2024-0716

Affected Products

Byzoro Smart S150 Management Platform

References · 9

• 🔥 https://github.com/GTA12138/vul/blob/main/smart%20s150/s150%20Download%20any%20file/smart%20s150%20download%20any%20file.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-0716 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0716 · Security Note
• https://twitter.com/VulmonFeeds/status/1748400261243064636 · Twitter Post
• https://twitter.com/CVEnew/status/1748363922166428074 · Twitter Post
• https://t.me/cvenotify/98927 · Telegram Post
• https://vuldb.com/?ctiid.251541 · Note
• https://vuldb.com/?submit.265177 · Note
• https://vuldb.com/?id.251541 · Note