An attacker could use specially crafted paths in a specific request to read or delete files from Relion 670 Series (versions 1p1r26, 1.2.3.17, 2.0.0.10, RES670 2.0.0.4, 2.1.0.1, and prior) outside the intended directory.
Un atacante podría utilizar rutas especialmente diseñadas en una petición específica para leer o eliminar archivos desde Relion 670 Series (versiones 1p1r26, 1.2.3.17, 2.0.0.10, RES670 2.0.0.4, 2.1.0.1 y anteriores) fuera del directorio previsto.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | CHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
AV:N/AC:L/Au:N/C:P/I:P/A:P
| Access Vector | NETWORK |
|---|---|
| Access Complexity | LOW |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | PARTIAL |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-22
|
| [email protected] | Primary |
en
CWE-22
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| hitachienergy | relion_670_firmware | * | <built-in method update of dict object at 0x72a9cc46f580> | Operating System |
| hitachienergy | relion_670_firmware | * | <built-in method update of dict object at 0x72a9b0a874c0> | Operating System |
| hitachienergy | relion_670_firmware | * | <built-in method update of dict object at 0x72a9b0a85040> | Operating System |
| hitachienergy | relion_670_firmware | * | <built-in method update of dict object at 0x72a9b0a86c40> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:hitachienergy:relion_670_firmware:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:hitachienergy:relion_670_firmware:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:hitachienergy:relion_670_firmware:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:hitachienergy:relion_670_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:hitachienergy:relion_670:-:*:*:*:*:*:*:* |