Lucene search

IcscertCVE-2024-43693

HistorySep 25, 2024 - 1:15 a.m.

CVE-2024-43693

2024-09-2501:15:43

CWE-77

icscert

web.nvd.nist.gov

vulnerability

remote

injection

progauge

maglink lx

console

utility

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVSS4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:H/VI:H/SI:H/VA:H/SA:H

AI Score

9.4

Confidence

High

EPSS

Percentile

9.6%

JSON

A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE
UTILITY sub-menu can allow a remote attacker to inject arbitrary
commands.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "ProGauge MAGLINK LX CONSOLE",
    "vendor": "Dover Fueling Solutions (DFS)",
    "versions": [
      {
        "lessThanOrEqual": "3.4.2.2.6",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "ProGauge MAGLINK LX4 CONSOLE",
    "vendor": "Dover Fueling Solutions (DFS)",
    "versions": [
      {
        "lessThanOrEqual": "4.17.9e",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cisa.gov/news-events/ics-advisories/icsa-24-268-04

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVSS4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:H/VI:H/SI:H/VA:H/SA:H

AI Score

9.4

Confidence

High

EPSS

Percentile

9.6%

JSON

Related for CVE-2024-43693