Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-27363 State: PUBLISHED Published: 2024-05-03T01:56:14.432Z Last Updated: 2024-08-02T12:09:43.350Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Reader Problem Types: CWE-749 Description: Foxit PDF Reader exportXFAData Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the exportXFAData method. The application exposes a JavaScript interf
a malicious file. The specific flaw exists within the exportXFAData method. The application exposes a JavaScript interface that allows writing arbitrary files. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-19697. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-491/ - https://www.foxit.com/support/security-bulletins.html
CVE ID: CVE-2023-27364 State: PUBLISHED Published: 2024-05-03T01:56:15.231Z Last Updated: 2024-09-18T18:28:05.297Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Editor Problem Types: CWE-749 Description: Foxit PDF Editor XLS File Parsing Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XLS files. The issue results from the lack of prope
pen a malicious file. The specific flaw exists within the parsing of XLS files. The issue results from the lack of proper restrictions on macro-enabled documents. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-19738. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-492/ - https://www.foxit.com/support/security-bulletins.html
CVE ID: CVE-2023-27365 State: PUBLISHED Published: 2024-05-03T01:56:15.953Z Last Updated: 2024-09-18T18:28:06.028Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Editor Problem Types: CWE-749 Description: Foxit PDF Editor DOC File Parsing Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DOC files. The issue results from the lack of prope
pen a malicious file. The specific flaw exists within the parsing of DOC files. The issue results from the lack of proper restrictions on macro-enabled documents. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-19739. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-493/ - https://www.foxit.com/support/security-bulletins.html
CVE ID: CVE-2023-27366 State: PUBLISHED Published: 2024-05-03T01:56:16.688Z Last Updated: 2024-08-02T12:09:43.420Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Reader Problem Types: CWE-416 Description: Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the exi
file. The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20225. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-494/ - https://www.foxit.com/support/security-bulletins.html
CVE ID: CVE-2023-27367 State: PUBLISHED Published: 2024-05-03T01:56:17.427Z Last Updated: 2024-08-02T12:09:43.430Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: NETGEAR Products: RAX30 Problem Types: CWE-78 Description: NETGEAR RAX30 libcms_cli Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the libcms_cli module. The issue results from the lack of proper validation of a us
sed. The specific flaw exists within the libcms_cli module. The issue results from the lack of proper validation of a user-supplied command before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19838. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-498/ - https://kb.netgear.com/000065619/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2022-0348
CVE ID: CVE-2023-27368 State: PUBLISHED Published: 2024-05-03T01:56:18.138Z Last Updated: 2024-08-02T12:09:43.325Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: NETGEAR Products: RAX30 Problem Types: CWE-121 Description: NETGEAR RAX30 soap_serverd Stack-based Buffer Overflow Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the soap_serverd binary. When parsing SOAP message headers, the process does not properly validate the length of user-supplied d
_serverd binary. When parsing SOAP message headers, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19839. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-499/ - https://kb.netgear.com/000065619/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2022-0348
CVE ID: CVE-2023-27369 State: PUBLISHED Published: 2024-05-03T01:56:18.923Z Last Updated: 2024-08-02T12:09:43.407Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: NETGEAR Products: RAX30 Problem Types: CWE-121 Description: NETGEAR RAX30 soap_serverd Stack-based Buffer Overflow Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30. Authentication is not required to exploit this vulnerability. The specific flaw exists within the soap_serverd binary. When parsing the request headers, the process does not properly validate the length of user-supplied data prior
binary. When parsing the request headers, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19840. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-500/ - https://kb.netgear.com/000065619/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2022-0348
CVE ID: CVE-2023-27370 State: PUBLISHED Published: 2024-05-03T01:56:19.685Z Last Updated: 2024-08-02T12:09:43.336Z Severity: MEDIUM (CVSS 5.7 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: NETGEAR Products: RAX30 Problem Types: CWE-312 Description: NETGEAR RAX30 Device Configuration Cleartext Storage Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR RAX30 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of device configuration. The issue results fro
n mechanism can be bypassed. The specific flaw exists within the handling of device configuration. The issue results from the storage of configuration secrets in plaintext. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19841. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-501/ - https://kb.netgear.com/000065619/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2022-0348
CVE ID: CVE-2023-27371 State: PUBLISHED Published: 2023-02-28T00:00:00.000Z Last Updated: 2025-03-11T15:19:04.055Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AC:H/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() func
, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.gnunet.org/libmicrohttpd.git/commit/?id=6d6846e20bfdf4b3eb1b592c97520a532f724238 - https://github.com/0xhebi/CVEs/tree/main/GNU%20Libmicrohttpd - https://lists.gnu.org/archive/html/libmicrohttpd/2023-02/msg00000.html - https://lists.debian.org/debian-lts-announce/2023/03/msg00029.html
CVE ID: CVE-2023-27372 State: PUBLISHED Published: 2023-02-28T00:00:00.000Z Last Updated: 2025-03-11T14:27:45.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-2-1-SPIP-4-1-8-SPIP-4-0-10-et.html - https://git.spip.net/spip/spip/commit/5aedf49b89415a4df3eb775eee3801a2b4b88266 - https://git.spip.net/spip/spip/commit/96fbeb38711c6706e62457f2b732a652
commit/5aedf49b89415a4df3eb775eee3801a2b4b88266 - https://git.spip.net/spip/spip/commit/96fbeb38711c6706e62457f2b732a652a04a409d - https://www.debian.org/security/2023/dsa-5367 - http://packetstormsecurity.com/files/171921/SPIP-Remote-Command-Execution.html - http://packetstormsecurity.com/files/173044/SPIP-4.2.1-Remote-Code-Execution.html
CVE ID: CVE-2023-27373 State: PUBLISHED Published: 2023-08-07T00:00:00.000Z Last Updated: 2025-03-07T19:25:36.184Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. Due to insufficient input validation, an attacker can tamper with a runtime-accessible EFI variable to cause a dynamic BAR setting to overlap SMRAM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge/SA-2023035
CVE ID: CVE-2023-27375 State: PUBLISHED Published: 2023-10-25T10:18:27.738Z Last Updated: 2024-09-25T11:50:23.158Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IDAttend Pty Ltd Products: IDWeb Problem Types: CWE-306 Description: Missing authentication in the StudentPopupDetails_ContactDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitive student data by unauthenticated attackers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2023-27375
CVE ID: CVE-2023-27376 State: PUBLISHED Published: 2023-10-25T10:19:16.295Z Last Updated: 2024-09-25T11:53:32.104Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IDAttend Pty Ltd Products: IDWeb Problem Types: CWE-306 Description: Missing authentication in the StudentPopupDetails_StudentDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitive student data by unauthenticated attackers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2023-27376
CVE ID: CVE-2023-27377 State: PUBLISHED Published: 2023-10-25T10:20:04.010Z Last Updated: 2024-09-25T11:56:35.090Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IDAttend Pty Ltd Products: IDWeb Problem Types: CWE-306 Description: Missing authentication in the StudentPopupDetails_EmergencyContactDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitive student data by unauthenticated attackers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2023-27377
CVE ID: CVE-2023-27378 State: PUBLISHED Published: 2023-05-03T14:33:49.646Z Last Updated: 2025-01-29T21:03:14.471Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-79 Description: Multiple reflected cross-site scripting (XSS) vulnerabilities exist in undisclosed pages of the BIG-IP Configuration utility which allow an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000132726
CVE ID: CVE-2023-27379 State: PUBLISHED Published: 2023-07-19T13:16:37.729Z Last Updated: 2024-08-02T12:09:43.432Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: Foxit Reader Problem Types: CWE-416 Description: A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 12.1.2.15332. By prematurely deleting objects associated with pages, a specially crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user vi
trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1756
CVE ID: CVE-2023-27380 State: PUBLISHED Published: 2023-10-11T15:16:56.947Z Last Updated: 2024-09-18T14:06:03.267Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Peplink Products: Surf SOHO HW1 Problem Types: CWE-78 Description: An OS command injection vulnerability exists in the admin.cgi USSD_send functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1780
CVE ID: CVE-2023-27382 State: PUBLISHED Published: 2023-05-10T13:16:40.215Z Last Updated: 2025-01-27T18:11:18.033Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) NUC P14E Laptop Element software for Windows 10 Problem Types: escalation of privilege, CWE-276 Description: Incorrect default permissions in the Audio Service for some Intel(R) NUC P14E Laptop Element software for Windows 10 before version 1.0.0.156 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/sec
CVE ID: CVE-2023-27383 State: PUBLISHED Published: 2023-11-14T19:05:05.093Z Last Updated: 2024-08-02T12:09:43.364Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) oneAPI HPC Toolkit 2023.1 and Intel(R)MPI Library software Problem Types: escalation of privilege, CWE-693 Description: Protection mechanism failure in some Intel(R) oneAPI HPC Toolkit 2023.1 and Intel(R)MPI Library software before version 2021.9 may allow a privileged user to potentially enable escalation of privilege via adjacent access. Additional Analyst Notes: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa
Notes: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00841.html
CVE ID: CVE-2023-27384 State: PUBLISHED Published: 2023-05-23T00:00:00 Last Updated: 2025-01-17T17:59:12.301Z Vendors: Cybozu, Inc. Products: Cybozu Garoon Problem Types: Improper access control Description: Operation restriction bypass vulnerability in MultiReport of Cybozu Garoon 5.15.0 allows a remote authenticated attacker to alter the data of MultiReport. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cs.cybozu.co.jp/2023/007698.html - https://jvn.jp/en/jp/JVN41694426/
CVE ID: CVE-2023-27385 State: PUBLISHED Published: 2023-05-10T00:00:00.000Z Last Updated: 2025-01-28T14:23:09.034Z Vendors: OMRON Corporation Products: CX-Drive All models Problem Types: Buffer overflow Description: Heap-based buffer overflow vulnerability exists in CX-Drive All models all versions. By having a user open a specially crafted SDD file, arbitrary code may be executed and/or information may be disclosed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ia.omron.com/product/vulnerability/OMSR-2023-004_en.pdf - https://jvn.jp/en/vu/JVNVU97372625/
CVE ID: CVE-2023-27386 State: PUBLISHED Published: 2023-05-10T13:16:44.347Z Last Updated: 2025-01-27T18:10:03.264Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Pathfinder for RISC-V software Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path in some Intel(R) Pathfinder for RISC-V software may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00855.html
CVE ID: CVE-2023-27387 State: PUBLISHED Published: 2023-05-23T00:00:00 Last Updated: 2025-01-17T17:55:21.222Z Vendors: T&D Corporation and ESPEC MIC CORP. Products: T&D Corporation and ESPEC MIC CORP. data logger products Problem Types: Cross-site request forgery Description: Cross-site request forgery (CSRF) in T&D Corporation and ESPEC MIC CORP. data logger products allows a remote unauthenticated attacker to conduct an arbitrary operation by having a logged-in user view a malicious page. Affected products and versions are as follows: T&D Corporation data logger products (TR-71W/72W all firmware versions, RTR-5W all firmware versions, WDR-7 all firmware versions, WDR-3 all firmware version
(TR-71W/72W all firmware versions, RTR-5W all firmware versions, WDR-7 all firmware versions, WDR-3 all firmware versions, and WS-2 all firmware versions), and ESPEC MIC CORP. data logger products (RT-12N/RS-12N all firmware versions, RT-22BN all firmware versions, and TEU-12N all firmware versions). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tandd.com/news/detail.html?id=780 - https://www.monitoring.especmic.co.jp/post/VulnerabilityInRT-12N_RS-12N_RT-22BNandTEU-12N - https://jvn.jp/en/jp/JVN14778242/
CVE ID: CVE-2023-27388 State: PUBLISHED Published: 2023-05-23T00:00:00.000Z Last Updated: 2025-01-31T13:55:50.063Z Vendors: T&D Corporation and ESPEC MIC CORP. Products: T&D Corporation and ESPEC MIC CORP. data logger products Problem Types: Improper authentication Description: Improper authentication vulnerability in T&D Corporation and ESPEC MIC CORP. data logger products allows a remote unauthenticated attacker to login to the product as a registered user. Affected products and versions are as follows: T&D Corporation data logger products (TR-71W/72W all firmware versions, RTR-5W all firmware versions, WDR-7 all firmware versions, WDR-3 all firmware versions, and WS-2 all firmware version
s, RTR-5W all firmware versions, WDR-7 all firmware versions, WDR-3 all firmware versions, and WS-2 all firmware versions), and ESPEC MIC CORP. data logger products (RT-12N/RS-12N all firmware versions, RT-22BN all firmware versions, and TEU-12N all firmware versions). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tandd.com/news/detail.html?id=780 - https://www.monitoring.especmic.co.jp/post/VulnerabilityInRT-12N_RS-12N_RT-22BNandTEU-12N - https://jvn.jp/en/jp/JVN14778242/
CVE ID: CVE-2023-27389 State: PUBLISHED Published: 2023-04-11T00:00:00.000Z Last Updated: 2025-02-10T21:31:14.807Z Vendors: Contec CO.,LTD. Products: CONPROSYS IoT Gateway products Problem Types: Inadequate encryption strength Description: Inadequate encryption strength vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker with an administrative privilege to apply a specially crafted Firmware update file, alter the information, cause a denial-of-service (DoS) condition, and/or execute arbitrary code. The affected products and versions are as follows: M2M Gateway with the firmware Ver.3.7.10 and earlier (CPS-MG341-ADSC1-111, CPS-MG341-ADSC1-931, CPS-MG341G-ADS
follows: M2M Gateway with the firmware Ver.3.7.10 and earlier (CPS-MG341-ADSC1-111, CPS-MG341-ADSC1-931, CPS-MG341G-ADSC1-111, CPS-MG341G-ADSC1-930, and CPS-MG341G5-ADSC1-931), M2M Controller Integrated Type with firmware Ver.3.7.6 and earlier versions (CPS-MC341-ADSC1-111, CPS-MC341-ADSC1-931, CPS-MC341-ADSC2-111, CPS-MC341G-ADSC1-110, CPS-MC341Q-ADSC1-111, CPS-MC341-DS1-111, CPS-MC341-DS11-111, CPS-MC341-DS2-911, and CPS-MC341-A1-111), and M2M Controller Configurable Type with firmware Ver.3.8.8 and earlier versions (CPS-MCS341-DS1-111, CPS-MCS341-DS1-131, CPS-MCS341G-DS1-130, CPS-MCS341G5-DS1-130, and CPS-MCS341Q-DS1-131). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vul