PT-2024-19805 · Unknown · Controller 6000+1

Published 2024-07-10 · Updated 2024-07-11 · CVE-2024-23317

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Controller 6000 and Controller 7000 versions 8.60 and prior Controller 6000 and Controller 7000 versions 8.70 prior to vCR8.70.240520a Controller 6000 and Controller 7000 versions 8.80 prior to vCR8.80.240520a Controller 6000 and Controller 7000 versions 8.90 prior to vCR8.90.240520a Controller 6000 and Controller 7000 versions 9.00 prior to vCR9.00.240521a Controller 6000 and Controller 7000 versions 9.10 prior to vCR9.10.240520a

Description The issue allows an attacker with local access to the Controller to perform arbitrary code execution due to External Control of File Name or Path. This can be exploited by an attacker to execute malicious code on the affected system.

Recommendations For versions 8.60 and prior, there is no information about a newer version that contains a fix for this issue. For version 8.70, update to vCR8.70.240520a or later. For version 8.80, update to vCR8.80.240520a or later. For version 8.90, update to vCR8.90.240520a or later. For version 9.00, update to vCR9.00.240521a or later. For version 9.10, update to vCR9.10.240520a or later.

Fix

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2024-23317

Affected Products

Controller 6000

Controller 7000

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-23317 · Security Note
• https://t.me/cvenotify/85761 · Telegram Post
• https://security.gallagher.com/Security-Advisories/CVE-2024-23317 · Note
• https://twitter.com/CVEnew/status/1811322661806756277 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1811275149364105631 · Twitter Post
• https://t.me/cvedetector/622 · Telegram Post