PT-2024-2172 · Unknown · F-Logic Datacube3

0Xsamy + 3 · Published 2024-02-28 · Updated 2025-06-10 · CVE-2024-25830

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions F-logic DataCube3 version 1.0

Description The issue is related to insufficient access control in the F-logic DataCube3 terminal measurement system software for power generation systems. This can be exploited by an unauthenticated, remote attacker to obtain the root and admin account passwords. The exploitation involves sending a URI with the path of the configuration file, taking advantage of improper directory access restrictions.

Recommendations For F-logic DataCube3 version 1.0, consider restricting access to the configuration file and implementing proper directory access controls to prevent unauthorized access until a patch is available. As a temporary workaround, limit remote access to the system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Path traversal

Weakness Enumeration

CWE-284

CWE-22

Related Identifiers

BDU:2024-02086

CVE-2024-25830

Affected Products

F-Logic Datacube3

References · 11

• 🔥 https://neroteam.com/blog/f-logic-datacube3-vulnerability-report · Exploit
• 🔥 https://exploit-db.com/exploits/51868 · Exploit
• https://osv.dev/vulnerability/CVE-2024-25830 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25830 · Security Note
• https://bdu.fstec.ru/vul/2024-02086 · Security Note
• https://t.me/cvenotify/125323 · Telegram Post
• https://twitter.com/freeprogrammers/status/1767389596717846682 · Twitter Post
• https://twitter.com/CVEnew/status/1762847264865722649 · Twitter Post
• https://vuldb.com/ru/?id.255109 · Note
• https://t.me/cvenotify/90399 · Telegram Post
• https://t.me/proxy_bar/1934 · Telegram Post