CVE-2023-35762

2023-11-2017:15:13

CWE-78

icscert

web.nvd.nist.gov

inea me rtu

firmware

vulnerability

os command injection

remote code execution

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.002

Percentile

56.1%

JSON

Versions of INEA ME RTU firmware 3.36b and prior are vulnerable to operating system (OS) command injection, which could allow remote code execution.

Affected configurations

Nvd

Node

ineame_rtuMatch-

AND

ineame_rtu_firmwareRange<3.37

VendorProductVersionCPE
ineame_rtu-cpe:2.3:h:inea:me_rtu:-:*:*:*:*:*:*:*
ineame_rtu_firmware*cpe:2.3:o:inea:me_rtu_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
inea	me_rtu	-	cpe:2.3:h:inea:me_rtu:-:::::::*
inea	me_rtu_firmware	*	cpe:2.3:o:inea:me_rtu_firmware::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "ME RTU",
    "vendor": "INEA",
    "versions": [
      {
        "lessThanOrEqual": "3.36b",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]