SB2023031711 - Multiple vulnerabilities in Contec CONPROSYS IoT Gateway products
Published: March 17, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) OS Command Injection (CVE-ID: CVE-2023-27917)
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation in the Network Maintenance page. A remote user can pass specially crafted data to the application and execute arbitrary OS commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
2) Inadequate Encryption Strength (CVE-ID: CVE-2023-27389)
The vulnerability allows a remote user to compromise the target system.
The vulnerability exists due to firmware update file contains a firmware image encrypted. A remote administrator can use a specially crafted Firmware update file and execute arbitrary code on the system.
3) Improper access control (CVE-ID: CVE-2023-23575)
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. A remote user can access Network Maintenance page to obtain the network information of the product.
Remediation
Install update from vendor's website.