Lucene search

IcscertVULNRICHMENT:CVE-2023-35762

HistoryNov 20, 2023 - 4:25 p.m.

CVE-2023-35762 OS Command Injection in INEA ME RTU

2023-11-2016:25:56

CWE-78

icscert

github.com

cve-2023-35762; os command injection; inea me rtu; firmware 3.36b; remote code execution

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

7.7

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

Versions of INEA ME RTU firmware 3.36b and prior are vulnerable to operating system (OS) command injection, which could allow remote code execution.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:h:inea:me_rtu:-:*:*:*:*:*:*:*"
    ],
    "vendor": "inea",
    "product": "me_rtu",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "3.36b"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

www.cisa.gov/news-events/ics-advisories/icsa-23-304-02

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

7.7

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

Related for VULNRICHMENT:CVE-2023-35762