CVE-2024-23492
Assigner: icscert
Published: 2024-03-01T20:56:33.687Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: WS203VICM
vendor: Commend
versions: lessThanOrEqual: 1.7
status: affected
version: 0
versionType: custom
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Aarón Flecha Menéndez of S21sec reported these vulnerabilities to CISA.
datePublic: 2024-02-20T20:48:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: 


A weak encoding is used to transmit credentials for WS203VICM.






value: 

A weak encoding is used to transmit credentials for WS203VICM.






metrics: cvssV3_1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-261
description: CWE-261
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: 
Although this is an end-of-life product, Commend has created new firmware <a target="_blank" rel="nofollow" href="https://clibrary-online.commend.com/">version WS-CM 2.0</a>&nbsp;<span style="background-color: var(--wht);">&nbsp;to
 address the first two issues. The new firmware can be loaded via the 
program "IP Station Config". To install the firmware, follow the 
instructions below:</span><ol>
<li>Log in to the Commend web-portal.</li>
<li>Download and extract the "Terminals Software Package".</li>
<li>In "IP Station Config", select the stations to be updated in the table.</li>
<li>Go to: Menu Station &gt; Firmware Download</li>
<li>Select the file "WS-CM 2.0.geh" from the folder "WS-CM" and click on the button Open.</li>
</ol>
<p>For additional information, please visit <a target="_blank" rel="nofollow" href="https://clibrary-online.commend.com/en/cyber-security/security-advisories.html">CSA-2024-42 on Commend's cybersecurity website.</a></p>

<br>
value: Although this is an end-of-life product, Commend has created new firmware  version WS-CM 2.0 https://clibrary-online.commend.com/   to
 address the first two issues. The new firmware can be loaded via the 
program "IP Station Config". To install the firmware, follow the 
instructions below:
  *  Log in to the Commend web-portal.

  *  Download and extract the "Terminals Software Package".

  *  In "IP Station Config", select the stations to be updated in the table.

  *  Go to: Menu Station > Firmware Download

  *  Select the file "WS-CM 2.0.geh" from the folder "WS-CM" and click on the button Open.


For additional information, please visit  CSA-2024-42 on Commend's cybersecurity website. https://clibrary-online.commend.com/en/cyber-security/security-advisories.html 





source: advisory: ICSA-24-051-01
discovery: EXTERNAL
title: Commend WS203VICM Weak Encoding for Password
x_generator: engine: Vulnogram 0.1.0-dev