by Kastro
Paper/Archive/CVE-2023-35762

CVE-2023-35762

INEA ME RTU — OS Command Injection in INEA ME RTU

EPSS 2%CVSS 9.9
critical.is priorityof 100
45
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 77.2.772 × 2015.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Versions of INEA ME RTU firmware 3.36b and prior are vulnerable to operating system (OS) command injection, which could allow remote code execution.

Affected

ProductAffectedFixed inSource
ME RTU≤ 3.36b–CNA
me_rtu≤ 3.36b–CISA-ADP

Scores by source

icscert (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-23-304-02