CVE-2017-6565

On Franklin Fueling Systems TS-550 evo 2.3.0.7332 devices, the roleDiag user, which can be obtained by exploiting CVE-2013-7247, has the ability to upload files to the server hosting the web service. As no sanitization checks are in place, an attacker can upload a malicious payload.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:franklinfueling:ts-550_evo_firmware:2.3.0.7332:*:*:*:*:*:*:*
cpe:2.3:h:franklinfueling:ts-550_evo:-:*:*:*:*:*:*:*

History

21 Nov 2024, 03:30

Type Values Removed Values Added
References () http://www.u235.io/single-post/2017/05/01/Penetrating-Fuel-Management-Systems - Technical Description, Third Party Advisory, URL Repurposed () http://www.u235.io/single-post/2017/05/01/Penetrating-Fuel-Management-Systems - Technical Description, Third Party Advisory, URL Repurposed
References () https://gist.github.com/Stick-U235/b187931f828e92866d09b9bdeb956ca2 - Third Party Advisory () https://gist.github.com/Stick-U235/b187931f828e92866d09b9bdeb956ca2 - Third Party Advisory

14 Feb 2024, 01:17

Type Values Removed Values Added
References (MISC) http://www.u235.io/single-post/2017/05/01/Penetrating-Fuel-Management-Systems - Technical Description, Third Party Advisory (MISC) http://www.u235.io/single-post/2017/05/01/Penetrating-Fuel-Management-Systems - Technical Description, Third Party Advisory, URL Repurposed

Information

Published : 2017-05-01 19:59

Updated : 2024-11-21 03:30


NVD link : CVE-2017-6565

Mitre link : CVE-2017-6565

CVE.ORG link : CVE-2017-6565


JSON object : View

Products Affected

franklinfueling

  • ts-550_evo
  • ts-550_evo_firmware
CWE
CWE-862

Missing Authorization