Lucene search

INCIBECVE-2023-4817

HistoryOct 03, 2023 - 4:15 p.m.

CVE-2023-4817

2023-10-0316:15:10

CWE-434

INCIBE

web.nvd.nist.gov

cve-2023-4817

vulnerability

authenticated attacker

upload

malicious files

bypassing restrictions

device compromise

nvd

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.4

Confidence

High

EPSS

0.001

Percentile

25.5%

JSON

This vulnerability allows an authenticated attacker to upload malicious files by bypassing the restrictions of the upload functionality, compromising the entire device.

Affected configurations

Nvd

Vulners

Node

icpdaset-7060Match-

AND

icpdaset-7060_firmwareMatch3.00

VendorProductVersionCPE
icpdaset-7060-cpe:2.3:h:icpdas:et-7060:-:*:*:*:*:*:*:*
icpdaset-7060_firmware3.00cpe:2.3:o:icpdas:et-7060_firmware:3.00:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
icpdas	et-7060	-	cpe:2.3:h:icpdas:et-7060:-:::::::*
icpdas	et-7060_firmware	3.00	cpe:2.3:o:icpdas:et-7060_firmware:3.00:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "ET-7060",
    "vendor": "ICP DAS",
    "versions": [
      {
        "status": "affected",
        "version": "3.00"
      }
    ]
  }
]

References

www.incibe.es/en/incibe-cert/notices/aviso/unrestricted-file-upload-vulnerability-icp-das-et-7060

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.4

Confidence

High

EPSS

0.001

Percentile

25.5%

JSON

Related for CVE-2023-4817