PT-2024-2268 · Unitronics · Unilogic

Published 2024-03-18 · Updated 2024-03-18 · CVE-2024-27770

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Unitronics Unistream Unilogic versions prior to 1.35.227

Description The issue is related to errors in processing relative path to directory, which can allow a remote attacker to bypass security restrictions and execute arbitrary code. This is a case of relative path traversal.

Recommendations For versions prior to 1.35.227, update to version 1.35.227 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive directories and implementing additional security measures to minimize the risk of exploitation.

Fix

Relative Path Traversal

Path traversal

Weakness Enumeration

CWE-23

CWE-22

Related Identifiers

BDU:2024-02201

CVE-2024-27770

Affected Products

Unilogic

References · 7

• https://osv.dev/vulnerability/CVE-2024-27770 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27770 · Security Note
• https://bdu.fstec.ru/vul/2024-02201 · Security Note
• https://twitter.com/cracbot/status/1769964448469422370 · Twitter Post
• https://gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0 · Note
• https://claroty.com/team82/disclosure-dashboard/cve-2024-27770 · Note
• https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered · Note