Softing edgeAggregator Restore Configuration Directory Traversal Remote Code Execution Vulnerability
CVE-2023-38126

7.2HIGH

Key Information:

Vendor

Softing

Status
Edgeaggregator
Vendor
CVE Published:
19 December 2023

What is CVE-2023-38126?

The edgeAggregator software from Softing contains a vulnerability that allows remote attackers to execute arbitrary code. This flaw originates from insufficient validation of user input in backup zip file processing. By manipulating the path provided during file operations, an unauthorized user can exploit this weakness. Notably, the vulnerability necessitates authentication for exploitation, emphasizing the importance of safeguarding access controls. This incident underscores the necessity for robust security practices in managing application configurations.

Affected Version(s)

edgeAggregator 3.40

References

https://www.zerodayinitiative.com/advisories/ZDI-23-1058/
x_research-advisory

EPSS Score

71% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

CVSS V3.0

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.