Path traversal in Emerson products - CVE-2021-24769
Published: October 6, 2021
Vulnerability identifier: #VU57093
CSH Severity: Medium
CVSS v4: 6.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-24769
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences. A remote authenticated attacker can send a specially crafted HTTP request and read arbitrary files on the system.
Affected software
WirelessHART 1410 Gateway
WirelessHART 1410D Gateway
WirelessHART 1420 Gateway
WirelessHART 1410D Gateway
WirelessHART 1420 Gateway
How to mitigate CVE-2021-24769
Install update from vendor's website.
WirelessHART 1410 Gateway - addressed in versions 4.7.94, 4.7.105
WirelessHART 1410D Gateway - addressed in versions 4.7.94, 4.7.105
WirelessHART 1420 Gateway - addressed in versions 4.7.94, 4.7.105
WirelessHART 1410D Gateway - addressed in versions 4.7.94, 4.7.105
WirelessHART 1420 Gateway - addressed in versions 4.7.94, 4.7.105