CVE-2023-45599

MEDIUM5.5

A CWE-646 “Reliance on File Name or Extension of Externally-Supplied File” vulnerability in the “iec61850” functionality of the web application allows a remote authenticated attacker to upload any arbitrary type of file into the device

Published Mar 5, 2024

Modified 2 years ago

Details

A CWE-646 “Reliance on File Name or Extension of Externally-Supplied File” vulnerability in the “iec61850” functionality of the web application allows a remote authenticated attacker to upload any arbitrary type of file into the device. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2.

References

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2023-45599

WEB

https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45599

CVSS Analysis

CVSS v3.1

5.5

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

HighAC:H

Privileges Required

HighPR:H

User Interaction

NoneUI:N

Scope

ChangedS:C

Impact

Confidentiality

LowC:L

Integrity

LowI:L

Availability

LowA:L

5.5/CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L

Weakness Type (CWE)

Other

CWE-646

Ecosystems

Timeline

PublishedMar 5, 2024

ModifiedAug 2, 2024