On Franklin Fueling Systems TS-550 evo 2.3.0.7332 devices, the roleDiag user, which can be obtained by exploiting CVE-2013-7247, has the ability to upload files to the server hosting the web service. As no sanitization checks are in place, an attacker can upload a malicious payload.
References
Link | Resource |
---|---|
http://www.u235.io/single-post/2017/05/01/Penetrating-Fuel-Management-Systems | Technical Description Third Party Advisory URL Repurposed |
https://gist.github.com/Stick-U235/b187931f828e92866d09b9bdeb956ca2 | Third Party Advisory |
http://www.u235.io/single-post/2017/05/01/Penetrating-Fuel-Management-Systems | Technical Description Third Party Advisory URL Repurposed |
https://gist.github.com/Stick-U235/b187931f828e92866d09b9bdeb956ca2 | Third Party Advisory |
Configurations
Configuration 1 (hide)
AND |
|
History
21 Nov 2024, 03:30
Type | Values Removed | Values Added |
---|---|---|
References | () http://www.u235.io/single-post/2017/05/01/Penetrating-Fuel-Management-Systems - Technical Description, Third Party Advisory, URL Repurposed | |
References | () https://gist.github.com/Stick-U235/b187931f828e92866d09b9bdeb956ca2 - Third Party Advisory |
14 Feb 2024, 01:17
Type | Values Removed | Values Added |
---|---|---|
References | (MISC) http://www.u235.io/single-post/2017/05/01/Penetrating-Fuel-Management-Systems - Technical Description, Third Party Advisory, URL Repurposed |
Information
Published : 2017-05-01 19:59
Updated : 2024-11-21 03:30
NVD link : CVE-2017-6565
Mitre link : CVE-2017-6565
CVE.ORG link : CVE-2017-6565
JSON object : View
Products Affected
franklinfueling
- ts-550_evo
- ts-550_evo_firmware
CWE
CWE-862
Missing Authorization