CVE-2019-18253 Path traversal in Relion 670 Series
Attackers can read or delete files outside the intended directory in Relion 670 Series devices via crafted paths.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-18253?
CVE-2019-18253 is a critical path traversal vulnerability in Relion 670 Series, published on 27 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An attacker could use specially crafted paths in a specific request to read or delete files from Relion 670 Series (versions 1p1r26, 1.2.3.17, 2.0.0.10, RES670 2.0.0.4, 2.1.0.1, and prior) outside the intended directory.
Weakness: CWE-22
Which versions are affected by CVE-2019-18253?
It affects 1 product.
Products include Hitachienergy Relion 670 Firmware.
How do I fix CVE-2019-18253?
No fix has been published for CVE-2019-18253 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2019-18253 being exploited?
There is no known exploitation of CVE-2019-18253 in the wild and no public exploit code.
Sources
Also known as GHSA-qjjj-g2xr-56qr.