Lucene search

JpcertCVE-2023-27917

HistoryApr 11, 2023 - 9:15 a.m.

CVE-2023-27917

2023-04-1109:15:08

CWE-78

jpcert

web.nvd.nist.gov

cve-2023-27917

os command injection

conprosys iot gateway

remote attacker

root privilege

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.007

Percentile

81.3%

JSON

OS command injection vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker who can access Network Maintenance page to execute arbitrary OS commands with a root privilege. The affected products and versions are as follows: M2M Gateway with the firmware Ver.3.7.10 and earlier (CPS-MG341-ADSC1-111, CPS-MG341-ADSC1-931, CPS-MG341G-ADSC1-111, CPS-MG341G-ADSC1-930, and CPS-MG341G5-ADSC1-931), M2M Controller Integrated Type with firmware Ver.3.7.6 and earlier versions (CPS-MC341-ADSC1-111, CPS-MC341-ADSC1-931, CPS-MC341-ADSC2-111, CPS-MC341G-ADSC1-110, CPS-MC341Q-ADSC1-111, CPS-MC341-DS1-111, CPS-MC341-DS11-111, CPS-MC341-DS2-911, and CPS-MC341-A1-111), and M2M Controller Configurable Type with firmware Ver.3.8.8 and earlier versions (CPS-MCS341-DS1-111, CPS-MCS341-DS1-131, CPS-MCS341G-DS1-130, CPS-MCS341G5-DS1-130, and CPS-MCS341Q-DS1-131).

Affected configurations

Nvd

Node

conteccps-mg341-adsc1-111_firmwareRange≤3.7.10

AND

conteccps-mg341-adsc1-111Match-

Node

conteccps-mg341-adsc1-931_firmwareRange≤3.7.10

AND

conteccps-mg341-adsc1-931Match-

Node

conteccps-mg341g-adsc1-111_firmwareRange≤3.7.10

AND

conteccps-mg341g-adsc1-111Match-

Node

conteccps-mg341g-adsc1-930_firmwareRange≤3.7.10

AND

conteccps-mg341g-adsc1-930Match-

Node

conteccps-mg341g5-adsc1-931_firmwareRange≤3.7.10

AND

conteccps-mg341g5-adsc1-931Match-

Node

conteccps-mc341-adsc1-111_firmwareRange≤3.7.6

AND

conteccps-mc341-adsc1-111Match-

Node

conteccps-mc341-adsc1-931_firmwareRange≤3.7.6

AND

conteccps-mc341-adsc1-931Match-

Node

conteccps-mc341-adsc2-111_firmwareRange≤3.7.6

AND

conteccps-mc341-adsc2-111Match-

Node

conteccps-mc341g-adsc1-110_firmwareRange≤3.7.6

AND

conteccps-mc341g-adsc1-110Match-

Node

conteccps-mc341q-adsc1-111_firmwareRange≤3.7.6

AND

conteccps-mc341q-adsc1-111Match-

Node

conteccps-mc341-ds1-111_firmwareRange≤3.7.6

AND

conteccps-mc341-ds1-111Match-

Node

conteccps-mc341-ds11-111_firmwareRange≤3.7.6

AND

conteccps-mc341-ds11-111Match-

Node

conteccps-mc341-ds2-911_firmwareRange≤3.7.6

AND

conteccps-mc341-ds2-911Match-

Node

conteccps-mc341-a1-111_firmwareRange≤3.7.6

AND

conteccps-mc341-a1-111Match-

Node

conteccps-mcs341-ds1-111_firmwareRange≤3.8.8

AND

conteccps-mcs341-ds1-111Match-

Node

conteccps-mcs341-ds1-131_firmwareRange≤3.8.8

AND

conteccps-mcs341-ds1-131Match-

Node

conteccps-mcs341g-ds1-130_firmwareRange≤3.8.8

AND

conteccps-mcs341g-ds1-130Match-

Node

conteccps-mcs341g5-ds1-130_firmwareRange≤3.8.8

AND

conteccps-mcs341g5-ds1-130Match-

Node

conteccps-mcs341q-ds1-131_firmwareRange≤3.8.8

AND

conteccps-mcs341q-ds1-131Match-

VendorProductVersionCPE
conteccps-mg341-adsc1-111_firmware*cpe:2.3:o:contec:cps-mg341-adsc1-111_firmware:*:*:*:*:*:*:*:*
conteccps-mg341-adsc1-111-cpe:2.3:h:contec:cps-mg341-adsc1-111:-:*:*:*:*:*:*:*
conteccps-mg341-adsc1-931_firmware*cpe:2.3:o:contec:cps-mg341-adsc1-931_firmware:*:*:*:*:*:*:*:*
conteccps-mg341-adsc1-931-cpe:2.3:h:contec:cps-mg341-adsc1-931:-:*:*:*:*:*:*:*
conteccps-mg341g-adsc1-111_firmware*cpe:2.3:o:contec:cps-mg341g-adsc1-111_firmware:*:*:*:*:*:*:*:*
conteccps-mg341g-adsc1-111-cpe:2.3:h:contec:cps-mg341g-adsc1-111:-:*:*:*:*:*:*:*
conteccps-mg341g-adsc1-930_firmware*cpe:2.3:o:contec:cps-mg341g-adsc1-930_firmware:*:*:*:*:*:*:*:*
conteccps-mg341g-adsc1-930-cpe:2.3:h:contec:cps-mg341g-adsc1-930:-:*:*:*:*:*:*:*
conteccps-mg341g5-adsc1-931_firmware*cpe:2.3:o:contec:cps-mg341g5-adsc1-931_firmware:*:*:*:*:*:*:*:*
conteccps-mg341g5-adsc1-931-cpe:2.3:h:contec:cps-mg341g5-adsc1-931:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
contec	cps-mg341-adsc1-111_firmware	*	cpe:2.3:o:contec:cps-mg341-adsc1-111_firmware::::::::
contec	cps-mg341-adsc1-111	-	cpe:2.3:h:contec:cps-mg341-adsc1-111:-:::::::*
contec	cps-mg341-adsc1-931_firmware	*	cpe:2.3:o:contec:cps-mg341-adsc1-931_firmware::::::::
contec	cps-mg341-adsc1-931	-	cpe:2.3:h:contec:cps-mg341-adsc1-931:-:::::::*
contec	cps-mg341g-adsc1-111_firmware	*	cpe:2.3:o:contec:cps-mg341g-adsc1-111_firmware::::::::
contec	cps-mg341g-adsc1-111	-	cpe:2.3:h:contec:cps-mg341g-adsc1-111:-:::::::*
contec	cps-mg341g-adsc1-930_firmware	*	cpe:2.3:o:contec:cps-mg341g-adsc1-930_firmware::::::::
contec	cps-mg341g-adsc1-930	-	cpe:2.3:h:contec:cps-mg341g-adsc1-930:-:::::::*
contec	cps-mg341g5-adsc1-931_firmware	*	cpe:2.3:o:contec:cps-mg341g5-adsc1-931_firmware::::::::
contec	cps-mg341g5-adsc1-931	-	cpe:2.3:h:contec:cps-mg341g5-adsc1-931:-:::::::*

Rows per page:

1-10 of 381

CNA Affected

[
  {
    "vendor": "Contec CO.,LTD.",
    "product": "CONPROSYS IoT Gateway products",
    "versions": [
      {
        "version": "M2M Gateway with the firmware Ver.3.7.10 and earlier (CPS-MG341-ADSC1-111, CPS-MG341-ADSC1-931, CPS-MG341G-ADSC1-111, CPS-MG341G-ADSC1-930, and CPS-MG341G5-ADSC1-931), M2M Controller Integrated Type with firmware Ver.3.7.6 and earlier versions (CPS-MC341-ADSC1-111, CPS-MC341-ADSC1-931, CPS-MC341-ADSC2-111, CPS-MC341G-ADSC1-110, CPS-MC341Q-ADSC1-111, CPS-MC341-DS1-111, CPS-MC341-DS11-111, CPS-MC341-DS2-911, and CPS-MC341-A1-111), and M2M Controller Configurable Type with firmware Ver.3.8.8 and earlier versions (CPS-MCS341-DS1-111, CPS-MCS341-DS1-131, CPS-MCS341G-DS1-130, CPS-MCS341G5-DS1-130, and CPS-MCS341Q-DS1-131)",
        "status": "affected"
      }
    ]
  }
]

References

jvn.jp/en/vu/JVNVU96198617/

www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_cps_230317_en.pdf

www.contec.com/download/donwload-list/?itemid=a054b3eb-da97-40d0-9598-d7f5ff4239ec#firmware

www.contec.com/download/donwload-list/?itemid=a1b33f0d-d32b-4549-9741-613cd37d5528#firmware

www.contec.com/download/donwload-list/?itemid=f832c526-dcf6-4976-85aa-f536c15a8120#firmware

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.007

Percentile

81.3%

JSON

Related for CVE-2023-27917