PT-2024-8008 · Unknown · Telecontrol Server Basic

Published

2024-08-20

·

Updated

2024-11-17

·

CVE-2024-44102

CVSS v4.0

10

Critical

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions PP TeleControl Server Basic versions prior to V3.1.2.1 with redundancy configured TeleControl Server Basic versions prior to V3.1.2.1 with redundancy configured
Description The affected system allows remote users to send maliciously crafted objects. Due to insecure deserialization of user-supplied content by the affected software, an unauthenticated attacker could exploit this vulnerability by sending a maliciously crafted serialized object. This could allow the attacker to execute arbitrary code on the device with SYSTEM privileges.
Recommendations For PP TeleControl Server Basic versions prior to V3.1.2.1 with redundancy configured, update to version V3.1.2.1 or later to resolve the issue. For TeleControl Server Basic versions prior to V3.1.2.1 with redundancy configured, update to version V3.1.2.1 or later to resolve the issue. As a temporary workaround, consider disabling the deserialization of user-supplied content until a patch is available. Restrict access to the affected system to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2024-09525
CVE-2024-44102

Affected Products

Telecontrol Server Basic