CVE-2023-27389 Weak cryptography in CONPROSYS IoT Gateway products
Remote authenticated administrators can exploit weak encryption to upload malicious firmware, leading to arbitrary code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-27389?
CVE-2023-27389 is a high-severity vulnerability in Contec CO.,LTD. CONPROSYS IoT Gateway products, published on 11 Apr 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Inadequate encryption strength vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker with an administrative privilege to apply a specially crafted Firmware update file, alter the information, cause a denial-of-service (DoS) condition, and/or execute arbitrary code. The affected products and versions are as follows: M2M Gateway with the firmware Ver.3.7.10 and earlier (CPS-MG341-ADSC1-111, CPS-MG341-ADSC1-931, CPS-MG341G-ADSC1-111, CPS-MG341G-ADSC1-930, and CPS-MG341G5-ADSC1-931), M2M Controller Integrated Type with firmware Ver.3.7.6 and earlier versions (CPS-MC341-ADSC1-111, CPS-MC341-ADSC1-931, CPS-MC341-ADSC2-111, CPS-MC341G-ADSC1-110, CPS-MC341Q-ADSC1-111, CPS-MC341-DS1-111, CPS-MC341-DS11-111, CPS-MC341-DS2-911, and CPS-MC341-A1-111), and M2M Controller Configurable Type with firmware Ver.3.8.8 and earlier versions (CPS-MCS341-DS1-111, CPS-MCS341-DS1-131, CPS-MCS341G-DS1-130, CPS-MCS341G5-DS1-130, and CPS-MCS341Q-DS1-131).
Weakness: CWE-326
Which versions are affected by CVE-2023-27389?
It affects 19 products.
Products include Contec Cps-Mc341-A1-111 Firmware, Contec Cps-Mc341-Adsc1-111 Firmware, Contec Cps-Mc341-Adsc1-931 Firmware, Contec Cps-Mc341-Adsc2-111 Firmware, Contec Cps-Mc341-Ds1-111 Firmware, Contec Cps-Mc341-Ds11-111 Firmware and 13 more.
How do I fix CVE-2023-27389?
No fix has been published for CVE-2023-27389 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-27389 being exploited?
There is no known exploitation of CVE-2023-27389 in the wild and no public exploit code.
Other vulnerabilities in Contec CO.,LTD. CONPROSYS IoT Gateway products
Sources
Also known as GHSA-88r9-vcj8-625f.