PT-2024-21072 · Avsystem · Avsystem Unified Management Platform

Published 2024-03-18 · Updated 2024-08-02 · CVE-2024-25656

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions AVSystem Unified Management Platform (UMP) version 23.07.0.16567~LTS

Description The issue is related to improper input validation, which can result in unauthenticated Customer Premises Equipment (CPE) devices storing arbitrarily large amounts of data during registration. This can potentially lead to DDoS attacks on the application database and affect the entire product.

Recommendations For AVSystem Unified Management Platform (UMP) version 23.07.0.16567~LTS, consider implementing proper input validation to prevent unauthenticated CPE devices from storing large amounts of data. As a temporary workaround, restrict access to the registration process to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-25656

Affected Products

Avsystem Unified Management Platform

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-25656 · Security Note
• https://twitter.com/CVEnew/status/1769826078959554603 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1769868901473550715 · Twitter Post
• https://t.me/cvenotify/88583 · Telegram Post
• https://cvcn.gov.it/cvcn/cve/CVE-2024-25656 · Note