CVE-2023-37607

Directory Traversal in Automatic Systems SOC FL9600 FirstLane V06 lego_T04E00 allows a remote attacker to obtain sensitive information via csvServer.php?file= with a .. in the dir parameter.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/CQURE/CVEs/blob/main/CVE-2023-37607/README.md	Exploit Third Party Advisory
https://www.automatic-systems.com/range/
http://automatic-systems.com
http://soc.com
https://github.com/CQURE/CVEs/blob/main/CVE-2023-37607/README.md	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:automaticsystems:soc_fl9600_firstlane_firmware:06:*:*:*:*:*:*:*

cpe:2.3:h:automaticsystems:soc_fl9600_firstlane:-:*:*:*:*:*:*:*

History

21 Nov 2024, 08:12

Type	Values Removed	Values Added
References		() http://automatic-systems.com - () http://soc.com -
References	~~() https://github.com/CQURE/CVEs/blob/main/CVE-2023-37607/README.md - Exploit, Third Party Advisory~~	() https://github.com/CQURE/CVEs/blob/main/CVE-2023-37607/README.md - Exploit, Third Party Advisory

31 Oct 2024, 04:15

Type	Values Removed	Values Added
Summary	~~(en) Directory Traversal in Automatic Systems SOC FL9600 FirstLane lego_T04E00 allows a remote attacker to obtain sensitive information via csvServer.php?file= with a .. in the dir parameter.~~	(en) Directory Traversal in Automatic Systems SOC FL9600 FirstLane V06 lego_T04E00 allows a remote attacker to obtain sensitive information via csvServer.php?file= with a .. in the dir parameter.

31 Oct 2024, 03:15

Type	Values Removed	Values Added
Summary	~~(en) Directory Traversal in Automatic-Systems SOC FL9600 FastLine lego_T04E00 allows a remote attacker to obtain sensitive information.~~	(en) Directory Traversal in Automatic Systems SOC FL9600 FirstLane lego_T04E00 allows a remote attacker to obtain sensitive information via csvServer.php?file= with a .. in the dir parameter.
References	~~{'url': 'http://automatic-systems.com', 'tags': ['Product'], 'source': 'cve@mitre.org'}~~ ~~{'url': 'http://soc.com', 'tags': ['Permissions Required'], 'source': 'cve@mitre.org'}~~	() https://www.automatic-systems.com/range/ -

09 Jan 2024, 20:34

Type	Values Removed	Values Added
References	~~() http://soc.com -~~	() http://soc.com - Permissions Required
References	~~() https://github.com/CQURE/CVEs/blob/main/CVE-2023-37607/README.md -~~	() https://github.com/CQURE/CVEs/blob/main/CVE-2023-37607/README.md - Exploit, Third Party Advisory
References	~~() http://automatic-systems.com -~~	() http://automatic-systems.com - Product
CPE		cpe:2.3:h:automaticsystems:soc_fl9600_firstlane:-:::::::* cpe:2.3:o:automaticsystems:soc_fl9600_firstlane_firmware:06:::::::*
First Time		Automaticsystems Automaticsystems soc Fl9600 Firstlane Firmware Automaticsystems soc Fl9600 Firstlane
CWE		CWE-22
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5

03 Jan 2024, 14:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-01-03 14:15

Updated : 2024-11-21 08:12

NVD link : CVE-2023-37607

Mitre link : CVE-2023-37607

CVE.ORG link : CVE-2023-37607

JSON object : View

Products Affected

automaticsystems

soc_fl9600_firstlane
soc_fl9600_firstlane_firmware

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

7.5 /10