Lucene search

[email protected]CVE-2023-23575

HistoryApr 11, 2023 - 9:15 a.m.

CVE-2023-23575

2023-04-1109:15:07

[email protected]

web.nvd.nist.gov

cve-2023-23575

improper access control

conprosys

iot gateway

network maintenance

firmware vulnerability

information security

nvd

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.3 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.0%

JSON

Improper access control vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker to bypass access restriction and access Network Maintenance page, which may result in obtaining the network information of the product. The affected products and versions are as follows: M2M Gateway with the firmware Ver.3.7.10 and earlier (CPS-MG341-ADSC1-111, CPS-MG341-ADSC1-931, CPS-MG341G-ADSC1-111, CPS-MG341G-ADSC1-930, and CPS-MG341G5-ADSC1-931), M2M Controller Integrated Type with firmware Ver.3.7.6 and earlier versions (CPS-MC341-ADSC1-111, CPS-MC341-ADSC1-931, CPS-MC341-ADSC2-111, CPS-MC341G-ADSC1-110, CPS-MC341Q-ADSC1-111, CPS-MC341-DS1-111, CPS-MC341-DS11-111, CPS-MC341-DS2-911, and CPS-MC341-A1-111), and M2M Controller Configurable Type with firmware Ver.3.8.8 and earlier versions (CPS-MCS341-DS1-111, CPS-MCS341-DS1-131, CPS-MCS341G-DS1-130, CPS-MCS341G5-DS1-130, and CPS-MCS341Q-DS1-131).

Affected configurations

NVD

Node

conteccps-mg341-adsc1-111_firmwareRange≤3.7.10

AND

conteccps-mg341-adsc1-111Match-

Node

conteccps-mg341-adsc1-931_firmwareRange≤3.7.10

AND

conteccps-mg341-adsc1-931Match-

Node

conteccps-mg341g-adsc1-111_firmwareRange≤3.7.10

AND

conteccps-mg341g-adsc1-111Match-

Node

conteccps-mg341g-adsc1-930_firmwareRange≤3.7.10

AND

conteccps-mg341g-adsc1-930Match-

Node

conteccps-mg341g5-adsc1-931_firmwareRange≤3.7.10

AND

conteccps-mg341g5-adsc1-931Match-

Node

conteccps-mc341-adsc1-111_firmwareRange≤3.7.6

AND

conteccps-mc341-adsc1-111Match-

Node

conteccps-mc341-adsc1-931_firmwareRange≤3.7.6

AND

conteccps-mc341-adsc1-931Match-

Node

conteccps-mc341-adsc2-111_firmwareRange≤3.7.6

AND

conteccps-mc341-adsc2-111Match-

Node

conteccps-mc341g-adsc1-110_firmwareRange≤3.7.6

AND

conteccps-mc341g-adsc1-110Match-

Node

conteccps-mc341q-adsc1-111_firmwareRange≤3.7.6

AND

conteccps-mc341q-adsc1-111Match-

Node

conteccps-mc341-ds1-111_firmwareRange≤3.7.6

AND

conteccps-mc341-ds1-111Match-

Node

conteccps-mc341-ds11-111_firmwareRange≤3.7.6

AND

conteccps-mc341-ds11-111Match-

Node

conteccps-mc341-ds2-911_firmwareRange≤3.7.6

AND

conteccps-mc341-ds2-911Match-

Node

conteccps-mc341-a1-111_firmwareRange≤3.7.6

AND

conteccps-mc341-a1-111Match-

Node

conteccps-mcs341-ds1-111_firmwareRange≤3.8.8

AND

conteccps-mcs341-ds1-111Match-

Node

conteccps-mcs341-ds1-131_firmwareRange≤3.8.8

AND

conteccps-mcs341-ds1-131Match-

Node

conteccps-mcs341g-ds1-130_firmwareRange≤3.8.8

AND

conteccps-mcs341g-ds1-130Match-

Node

conteccps-mcs341g5-ds1-130_firmwareRange≤3.8.8

AND

conteccps-mcs341g5-ds1-130Match-

Node

conteccps-mcs341q-ds1-131_firmwareRange≤3.8.8

AND

conteccps-mcs341q-ds1-131Match-

CPENameOperatorVersion
contec:cps-mg341-adsc1-111_firmwarecontec cps-mg341-adsc1-111 firmwarele3.7.10

CPE	Name	Operator	Version
contec:cps-mg341-adsc1-111_firmware	contec cps-mg341-adsc1-111 firmware	le	3.7.10

CNA Affected

[
  {
    "vendor": "Contec CO.,LTD.",
    "product": "CONPROSYS IoT Gateway products",
    "versions": [
      {
        "version": "M2M Gateway with the firmware Ver.3.7.10 and earlier (CPS-MG341-ADSC1-111, CPS-MG341-ADSC1-931, CPS-MG341G-ADSC1-111, CPS-MG341G-ADSC1-930, and CPS-MG341G5-ADSC1-931), M2M Controller Integrated Type with firmware Ver.3.7.6 and earlier versions (CPS-MC341-ADSC1-111, CPS-MC341-ADSC1-931, CPS-MC341-ADSC2-111, CPS-MC341G-ADSC1-110, CPS-MC341Q-ADSC1-111, CPS-MC341-DS1-111, CPS-MC341-DS11-111, CPS-MC341-DS2-911, and CPS-MC341-A1-111), and M2M Controller Configurable Type with firmware Ver.3.8.8 and earlier versions (CPS-MCS341-DS1-111, CPS-MCS341-DS1-131, CPS-MCS341G-DS1-130, CPS-MCS341G5-DS1-130, and CPS-MCS341Q-DS1-131)",
        "status": "affected"
      }
    ]
  }
]

References

jvn.jp/en/vu/JVNVU96198617/

www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_cps_230317_en.pdf

www.contec.com/download/donwload-list/?itemid=a054b3eb-da97-40d0-9598-d7f5ff4239ec#firmware

www.contec.com/download/donwload-list/?itemid=a1b33f0d-d32b-4549-9741-613cd37d5528#firmware

www.contec.com/download/donwload-list/?itemid=f832c526-dcf6-4976-85aa-f536c15a8120#firmware

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.3 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.0%

JSON

Related for CVE-2023-23575

nvd1 prion1 cvelist1