CVE-2023-23575 Missing authorization in CONPROSYS IoT Gateway products
Remote authenticated attackers can bypass access restrictions to view network information on CONPROSYS IoT Gateway devices.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-23575?
CVE-2023-23575 is a medium-severity missing authorization vulnerability in Contec CO.,LTD. CONPROSYS IoT Gateway products, published on 11 Apr 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Improper access control vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker to bypass access restriction and access Network Maintenance page, which may result in obtaining the network information of the product. The affected products and versions are as follows: M2M Gateway with the firmware Ver.3.7.10 and earlier (CPS-MG341-ADSC1-111, CPS-MG341-ADSC1-931, CPS-MG341G-ADSC1-111, CPS-MG341G-ADSC1-930, and CPS-MG341G5-ADSC1-931), M2M Controller Integrated Type with firmware Ver.3.7.6 and earlier versions (CPS-MC341-ADSC1-111, CPS-MC341-ADSC1-931, CPS-MC341-ADSC2-111, CPS-MC341G-ADSC1-110, CPS-MC341Q-ADSC1-111, CPS-MC341-DS1-111, CPS-MC341-DS11-111, CPS-MC341-DS2-911, and CPS-MC341-A1-111), and M2M Controller Configurable Type with firmware Ver.3.8.8 and earlier versions (CPS-MCS341-DS1-111, CPS-MCS341-DS1-131, CPS-MCS341G-DS1-130, CPS-MCS341G5-DS1-130, and CPS-MCS341Q-DS1-131).
Weakness: CWE-284
Which versions are affected by CVE-2023-23575?
It affects 19 products.
Products include Contec Cps-Mc341-A1-111 Firmware, Contec Cps-Mc341-Adsc1-111 Firmware, Contec Cps-Mc341-Adsc1-931 Firmware, Contec Cps-Mc341-Adsc2-111 Firmware, Contec Cps-Mc341-Ds1-111 Firmware, Contec Cps-Mc341-Ds11-111 Firmware and 13 more.
How do I fix CVE-2023-23575?
No fix has been published for CVE-2023-23575 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-23575 being exploited?
There is no known exploitation of CVE-2023-23575 in the wild and no public exploit code.
Other vulnerabilities in Contec CO.,LTD. CONPROSYS IoT Gateway products
Sources
Also known as GHSA-gcwf-2p33-g9mp.