PT-2024-31878 · Socomec · Socomec Net Vision

José Daniel Martínez Coronel · Published 2024-05-07 · Updated 2024-05-07 · CVE-2024-4600

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Socomec Net Vision version 7.20

Description The issue is related to a Cross-Site Request Forgery vulnerability. This could allow an attacker to trick registered users into performing critical actions, such as adding and updating accounts, due to the lack of proper sanitisation of the set param.cgi file.

Recommendations For Socomec Net Vision version 7.20, consider disabling access to the set param.cgi file until a patch is available to prevent exploitation of this issue. Restricting user privileges to minimize the impact of potential unauthorized actions is also recommended. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-4600

Affected Products

Socomec Net Vision

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-4600 · Security Note
• https://t.me/cvenotify/79387 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-socomec-net-vision · Note
• https://twitter.com/CVEnew/status/1787888359123075251 · Twitter Post