Vulnerability-Lookup

BDU:2024-03898

Vulnerability from fstec - Published: 08.11.2023

Title

Уязвимость микропрограммного обеспечения модемов Telit Cinterion, связанная с использованием файлов и каталогов, доступных внешним сторонам, позволяющая нарушителю получить доступ на чтение и запись произвольных файлов(каталогов) в системе

Description

Уязвимость микропрограммного обеспечения модемов Telit Cinterion связана с использованием файлов и каталогов, доступных внешним сторонам. Эксплуатация уязвимости может позволить нарушителю получить доступ на чтение и запись произвольных файлов(каталогов) в системе

Severity


                    
                      AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vendor

Telit Cinterion, НПП «ИТЭЛМА»

Software Name

BGS5, EHS5, EHS6, EHS8, PDS5, PDS6, PDS8, ELS61, ELS81, PLS62, БЭГ ИТЭЛМА 1824.3879600, БЭГ ИТЭЛМА 8450020004, БЭГ ИТЭЛМА 8450031410, БЭГ ИТЭЛМА 8450008475, БЭГ ИТЭЛМА 8450033434, БЭГ ИТЭЛМА 8450103571, БЭГ ИТЭЛМА 8450103773, БЭГ ИТЭЛМА 8450042687, БЭГ ИТЭЛМА 111.3879000, БЭГ ИТЭЛМА 18.3879600-ХХ

Software Version

- (BGS5), - (EHS5), - (EHS6), - (EHS8), - (PDS5), - (PDS6), - (PDS8), - (ELS61), - (ELS81), - (PLS62), - (БЭГ ИТЭЛМА 1824.3879600), - (БЭГ ИТЭЛМА 8450020004), - (БЭГ ИТЭЛМА 8450031410), - (БЭГ ИТЭЛМА 8450008475), - (БЭГ ИТЭЛМА 8450033434), - (БЭГ ИТЭЛМА 8450103571), - (БЭГ ИТЭЛМА 8450103773), - (БЭГ ИТЭЛМА 8450042687), - (БЭГ ИТЭЛМА 111.3879000), - (БЭГ ИТЭЛМА 18.3879600-ХХ)

Possible Mitigations

Компенсирующие меры: - использование физического разграничения доступа к устройствам; - сегментирование сети для ограничения возможности доступа к промышленному сегменту из других подсетей; - ограничение доступа к устройству из внешних сетей (Интернет); - ограничение возможности подключения недоверенных USB-устройств; - использование виртуальных частных сетей для организации удаленного доступа (VPN).

Reference

https://ics-cert.kaspersky.ru/advisories/2023/11/08/klcert-22-194-telit-cinterion-thales-gemalto-modules-files-or-directories-accessible-to-external-parties-vulnerability https://www.cve.org/CVERecord?id=CVE-2023-47612

CWE

CWE-552

JSON

To clipboard

Loading 1.1 MB of JSON…

CVE-2023-47612 (GCVE-0-2023-47612)

Vulnerability from cvelistv5 – Published: 2023-11-09 12:07 – Updated: 2024-09-04 13:47

Summary

A CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow an attacker with physical access to the target system to obtain a read/write access to any files and directories on the targeted system, including hidden files and directories.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-04 13:32 UTC

CWE

CWE-552 - Files or Directories Accessible to External Parties

Assigner

Kaspersky mitre root

References

1 reference

URL	Tags
https://ics-cert.kaspersky.com/advisories/2023/11…	third-party-advisory

Impacted products

20 products

Vendor	Product	Version
Telit Cinterion	BGS5
Telit Cinterion	EHS5
Telit Cinterion	EHS6
Telit Cinterion	EHS8
Telit Cinterion	PDS5
Telit Cinterion	PDS6
Telit Cinterion	PDS8
Telit Cinterion	ELS61
Telit Cinterion	ELS81
Telit Cinterion	PLS62
telit_cinterion	bgs5	Affected: bgs5 cpe:2.3:a:telit_cinterion:bgs5::::::::
telit_cinterion	ehs5	Affected: ehs5 cpe:2.3:a:telit_cinterion:ehs5::::::::
telit_cinterion	ehs6	Affected: ehs6 cpe:2.3:a:telit_cinterion:ehs6::::::::
telit_cinterion	ehs8	Affected: ehs8 cpe:2.3:a:telit_cinterion:ehs8::::::::
telit_cinterion	pds5	Affected: pds5 cpe:2.3:a:telit_cinterion:pds5::::::::
telit_cinterion	pds6	Affected: pds6 cpe:2.3:a:telit_cinterion:pds6:pds6:::::::*
telit_cinterion	pds8	Affected: pds8 cpe:2.3:a:telit_cinterion:pds8::::::::
telit_cinterion	els61	Affected: els61 cpe:2.3:a:telit_cinterion:els61::::::::
telit_cinterion	els81	Affected: els81 cpe:2.3:a:telit_cinterion:els81::::::::
telit_cinterion	pls62	Affected: pls62 cpe:2.3:a:telit_cinterion:pls62::::::::

Credits

Alexander Kozlov from Kaspersky Sergey Anufrienko from Kaspersky

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T21:09:37.494Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "KLCERT-22-194: Telit Cinterion (Thales/Gemalto) modules. Files or Directories Accessible to External Parties vulnerability",
            "tags": [
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://ics-cert.kaspersky.com/advisories/2023/11/08/klcert-22-194-telit-cinterion-thales-gemalto-modules-files-or-directories-accessible-to-external-parties-vulnerability/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:telit_cinterion:bgs5:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "bgs5",
            "vendor": "telit_cinterion",
            "versions": [
              {
                "status": "affected",
                "version": "bgs5"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:telit_cinterion:ehs5:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ehs5",
            "vendor": "telit_cinterion",
            "versions": [
              {
                "status": "affected",
                "version": "ehs5"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:telit_cinterion:ehs6:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ehs6",
            "vendor": "telit_cinterion",
            "versions": [
              {
                "status": "affected",
                "version": "ehs6"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:telit_cinterion:ehs8:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ehs8",
            "vendor": "telit_cinterion",
            "versions": [
              {
                "status": "affected",
                "version": "ehs8"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:telit_cinterion:pds5:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "pds5",
            "vendor": "telit_cinterion",
            "versions": [
              {
                "status": "affected",
                "version": "pds5"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:telit_cinterion:pds6:pds6:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "pds6",
            "vendor": "telit_cinterion",
            "versions": [
              {
                "status": "affected",
                "version": "pds6"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:telit_cinterion:pds8:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "pds8",
            "vendor": "telit_cinterion",
            "versions": [
              {
                "status": "affected",
                "version": "pds8"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:telit_cinterion:els61:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "els61",
            "vendor": "telit_cinterion",
            "versions": [
              {
                "status": "affected",
                "version": "els61"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:telit_cinterion:els81:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "els81",
            "vendor": "telit_cinterion",
            "versions": [
              {
                "status": "affected",
                "version": "els81"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:telit_cinterion:pls62:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "pls62",
            "vendor": "telit_cinterion",
            "versions": [
              {
                "status": "affected",
                "version": "pls62"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-47612",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-04T13:32:02.787633Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-04T13:47:01.811Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "BGS5",
          "vendor": "Telit Cinterion"
        },
        {
          "defaultStatus": "affected",
          "product": "EHS5",
          "vendor": "Telit Cinterion"
        },
        {
          "defaultStatus": "affected",
          "product": "EHS6",
          "vendor": "Telit Cinterion"
        },
        {
          "defaultStatus": "affected",
          "product": "EHS8",
          "vendor": "Telit Cinterion"
        },
        {
          "defaultStatus": "affected",
          "product": "PDS5",
          "vendor": "Telit Cinterion"
        },
        {
          "defaultStatus": "affected",
          "product": "PDS6",
          "vendor": "Telit Cinterion"
        },
        {
          "defaultStatus": "affected",
          "product": "PDS8",
          "vendor": "Telit Cinterion"
        },
        {
          "defaultStatus": "affected",
          "product": "ELS61",
          "vendor": "Telit Cinterion"
        },
        {
          "defaultStatus": "affected",
          "product": "ELS81",
          "vendor": "Telit Cinterion"
        },
        {
          "defaultStatus": "affected",
          "product": "PLS62",
          "vendor": "Telit Cinterion"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alexander Kozlov from Kaspersky"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Sergey Anufrienko from Kaspersky"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow an attacker with physical access to the target system to obtain a read/write access to any files and directories on the targeted system, including hidden files and directories."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-552",
              "description": "CWE-552: Files or Directories Accessible to External Parties",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-09T17:12:52.926Z",
        "orgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
        "shortName": "Kaspersky"
      },
      "references": [
        {
          "name": "KLCERT-22-194: Telit Cinterion (Thales/Gemalto) modules. Files or Directories Accessible to External Parties vulnerability",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://ics-cert.kaspersky.com/advisories/2023/11/08/klcert-22-194-telit-cinterion-thales-gemalto-modules-files-or-directories-accessible-to-external-parties-vulnerability/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-02-21T12:45:00.000Z",
          "value": "Issue discovered by Kaspersky ICS CERT"
        },
        {
          "lang": "en",
          "time": "2023-04-27T15:56:00.000Z",
          "value": "Confirmed by Telit Cinterion"
        }
      ],
      "workarounds": [
        {
          "lang": "en",
          "value": "Control physical access to the device at all stages of transportation to protect against the embedding of backdoors."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
    "assignerShortName": "Kaspersky",
    "cveId": "CVE-2023-47612",
    "datePublished": "2023-11-09T12:07:54.815Z",
    "dateReserved": "2023-11-07T10:06:48.689Z",
    "dateUpdated": "2024-09-04T13:47:01.811Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

BDU:2024-03898

CVE-2023-47612 (GCVE-0-2023-47612)

Tags

Sightings

Nomenclature