Command injection in SenNet Data Logger - CVE-2017-6048

Vulnerability identifier: #VU6550

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-6048

CWE-ID: CWE-77

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote unauthenticated attacker to execute arbitrary commands on a targeted system.

The weakness exists due to insufficient validation of user-supplied input. A remote attacker can break out the jailed shell, gain elevated privileges and execute arbitrary commands on the system.

Successful exploitation of the vulnerability may result in full system compromise.

SenNet Data Logger

Install update from vendor's website.

• Exploit #58 - Satel Iberia SenNet Data Logger and Electricity Meters Command Injection Vulnerability (March 18, 2020)

• https://ics-cert.us-cert.gov/advisories/ICSA-17-131-02

• Command injection in Satel Iberia SenNet Data Logger