CVE-2023-2622 Information disclosure in MACH System Software
Authenticated low-privilege users can read arbitrary files on Hitachi Energy MACH systems via the InspectSetup RPC endpoint.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-2622?
CVE-2023-2622 is a low-severity vulnerability in Hitachi Energy MACH System Software, published on 1 Nov 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Authenticated clients can read arbitrary files on the MAIN Computer system using the remote procedure call (RPC) of the InspectSetup service endpoint. The low privilege client is then allowed to read arbitrary files that they do not have authorization to read.
Weakness: CWE-668
Which versions are affected by CVE-2023-2622?
It affects 1 product.
Products include Hitachienergy Modular Advanced Control for Hvdc.
How do I fix CVE-2023-2622?
No fix has been published for CVE-2023-2622 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-2622 being exploited?
There is no known exploitation of CVE-2023-2622 in the wild and no public exploit code.
Other vulnerabilities in Hitachi Energy MACH System Software
Sources
Also known as GHSA-pf76-3jj8-rpqg.