CVE-2023-2003
9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Summary
Embedded malicious code vulnerability in Vision1210, in the build 5 of operating system version 4.3, which could allow a remote attacker to store base64-encoded malicious code in the device's data tables via the PCOM protocol, which can then be retrieved by a client and executed on the device.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unitronics | Vision1210 | 4.3, build 5 | affected |
Weaknesses
- CWE-506: CWE-506: Embedded Malicious Code
ADP Enrichment
CVE Program Container
Additional References
- https://www.incibe.es/en/incibe-cert/notices/aviso-sci/embedded-malicious-code-vulnerability-unitronics-vision1210
- https://www.hackplayers.com/2023/07/vulnerabilidad-vision1210-unitronics.html
CISA ADP Vulnrichment
- SSVC:
- Exploitation: poc
- Automatable: yes
- Technical Impact: total
References
- https://www.incibe.es/en/incibe-cert/notices/aviso-sci/embedded-malicious-code-vulnerability-unitronics-vision1210
- https://www.hackplayers.com/2023/07/vulnerabilidad-vision1210-unitronics.html
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.