Lucene search

PRIOn knowledge basePRION:CVE-2023-46386

HistoryNov 30, 2023 - 11:15 p.m.

Authentication flaw

2023-11-3023:15:00

PRIOn knowledge base

www.prio-n.com

loytec

linx-212

linx-151

firmware

insecure permissions

registry.xml

remote attackers

smtp client account

credentials

bypass email authentication

vulnerability

7.3 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

45.2%

JSON

LOYTEC electronics GmbH LINX-212 firmware 6.2.4 and LINX-151 firmware 7.2.4 are vulnerable to Insecure Permissions via registry.xml file. This vulnerability allows remote attackers to disclose smtp client account credentials and bypass email authentication.

CPENameOperatorVersion
linx-151_firmwareeq7.2.4
linx-212_firmwareeq6.2.4

CPE	Name	Operator	Version
	linx-151_firmware	eq	7.2.4
	linx-212_firmware	eq	6.2.4

References

packetstormsecurity.com/files/175952/Loytec-L-INX-Automation-Servers-Information-Disclosure-Cleartext-Secrets.html

seclists.org/fulldisclosure/2023/Nov/7

www.txone.com/blog/ten-unpatched-vulnerabilities-in-building-automation-products-identified-by-txone-networks/