CVE-2017-6565

On Franklin Fueling Systems TS-550 evo 2.3.0.7332 devices, the roleDiag user, which can be obtained by exploiting CVE-2013-7247, has the ability to upload files to the server hosting the web service. As no sanitization checks are in place, an attacker can upload a malicious payload.
References
Link Resource
http://www.u235.io/single-post/2017/05/01/Penetrating-Fuel-Management-Systems Technical Description Third Party Advisory URL Repurposed
https://gist.github.com/Stick-U235/b187931f828e92866d09b9bdeb956ca2 Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:franklinfueling:ts-550_evo_firmware:2.3.0.7332:*:*:*:*:*:*:*
cpe:2.3:h:franklinfueling:ts-550_evo:-:*:*:*:*:*:*:*

History

14 Feb 2024, 01:17

Type Values Removed Values Added
References (MISC) http://www.u235.io/single-post/2017/05/01/Penetrating-Fuel-Management-Systems - Technical Description, Third Party Advisory (MISC) http://www.u235.io/single-post/2017/05/01/Penetrating-Fuel-Management-Systems - Technical Description, Third Party Advisory, URL Repurposed

Information

Published : 2017-05-01 19:59

Updated : 2024-02-28 15:44


NVD link : CVE-2017-6565

Mitre link : CVE-2017-6565

CVE.ORG link : CVE-2017-6565


JSON object : View

Products Affected

franklinfueling

  • ts-550_evo
  • ts-550_evo_firmware
CWE
CWE-862

Missing Authorization