Advantech R-SeeNet External Control of File Name or Path
CVE-2023-3256

8.8HIGH

Key Information:

Vendor
Advantech
Status
R-seenet
Vendor
CVE Published:
22 June 2023

Summary

The R-SeeNet version 2.4.22 by Advantech contains a vulnerability that permits low-level users to access and load local file contents. This could potentially expose sensitive information and compromise system integrity. It is crucial for organizations to assess their installation of R-SeeNet to protect against unauthorized file exposure and ensure the security of their information systems.

Affected Version(s)

R-SeeNet 0 <= 2.4.22

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-1...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Esjay, working with Trend Micro Zero Day Initiative, reported these vulnerabilities to CISA.
.