by Kastro
Paper/Archive/CVE-2023-2625

CVE-2023-2625

Hitachi Energy TXpert Hub CoreTec 4 — A vulnerability exists that can be exploited by an authenticated client that is connected to the same network segment as the CoreTec 4, h…

EPSS 0.5%CVSS 9.0
critical.is priorityof 100
35
CVSS 9.0 (CNA)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 41.3.413 × 208.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability exists that can be exploited by an authenticated client that is connected to the same network segment as the CoreTec 4, having any level of access VIEWER to ADMIN. To exploit the vulnerability the attacker can inject shell commands through a particular field of the web user interface that will be executed by the system.

Affected

ProductAffectedFixed inSource
TXpert Hub CoreTec 4TXpert Hub CoreTec 4 version 2.0.*–CNA
TXpert Hub CoreTec 4TXpert Hub CoreTec 4 version 2.1.*–CNA
TXpert Hub CoreTec 4TXpert Hub CoreTec 4 version 2.2.*–CNA
TXpert Hub CoreTec 4TXpert Hub CoreTec 4 version 2.3.*–CNA
TXpert Hub CoreTec 4TXpert Hub CoreTec 4 version 2.4.*–CNA

Scores by source

Hitachi Energy (CNA)9.0CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refsearch.abb.com/library/Download.aspx?DocumentID=8DBD000163&LanguageCode=en&DocumentPartId=&Action=Launch