Lucene search

Japan Vulnerability NotesJVN:57296685

HistoryJan 12, 2023 - 12:00 a.m.

JVN#57296685: Multiple vulnerabilities in PIXELA PIX-RT100

2023-01-1200:00:00

Japan Vulnerability Notes

jvn.jp

pix-rt100

vulnerabilities

os command injection

backdoor access

high base scores

arbitrary os command execution

undocumented telnet

ssh services

software update

rt100_teq_2.1.3_eq101.

8 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

26.6%

JSON

PIX-RT100 provided by PIXELA CORPORATION contains multiple vulnerabilities listed below.

OS command injection (CWE-78) - CVE-2023-22304

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Base Score: 8.0
CVSS v2	AV:A/AC:L/Au:S/C:C/I:C/A:C	Base Score: 7.7

Backdoor access issue (CWE-912) - CVE-2023-22316

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Base Score: 8.8
CVSS v2	AV:A/AC:L/Au:N/C:C/I:C/A:C	Base Score: 8.3

Impact

A user who can login to Setting of the product may execute an arbitrary OS command - CVE-2023-22304
A network-adjacent attacker may access the product via undocumented Telnet or SSH services - CVE-2023-22316

Solution

Update the Software
Update to the latest version according to the information provided by the developer.
According to the developer, these vulnerabilities have been fixed in version RT100_TEQ_2.1.3_EQ101.

Products Affected

PIX-RT100 versions RT100_TEQ_2.1.1_EQ101 and RT100_TEQ_2.1.2_EQ101

8 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

26.6%

JSON

Related for JVN:57296685