Keysight N6845A Relative Path Traversal
CVE-2023-34394
7.8HIGH
What is CVE-2023-34394?
In Keysight Geolocation Server versions up to and including 2.4.2, improper path validation allows attackers to upload malicious files or delete arbitrary files and directories with SYSTEM privileges. This exploitation can lead to a local privilege escalation attack or cause a denial-of-service condition, thereby compromising the integrity and availability of the server.
Affected Version(s)
N6845A Geolocation Server 0 <= 2.4.2
References
CVSS V3.1
Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
​Steven Seeley of Source Incite reported these vulnerabilities to CISA.