CVE-2023-5492

A vulnerability, which was classified as critical, was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928. Affected is an unknown function of the file /sysmanage/licence.php. The manipulation of the argument file_upload leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-241644. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
References
Link Resource
https://github.com/llixixi/cve/blob/main/s45_upload_licence.md Exploit Third Party Advisory
https://vuldb.com/?ctiid.241644 Third Party Advisory
https://vuldb.com/?id.241644 Permissions Required Third Party Advisory
https://vuldb.com/?submit.213949
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:byzoro:smart_s45f_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:byzoro:smart_s45f:-:*:*:*:*:*:*:*

History

09 Apr 2024, 09:15

Type Values Removed Values Added
References
  • () https://vuldb.com/?submit.213949 -
Summary (en) A vulnerability, which was classified as critical, was found in Beijing Baichuo Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928. Affected is an unknown function of the file /sysmanage/licence.php. The manipulation of the argument file_upload leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-241644. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. (en) A vulnerability, which was classified as critical, was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928. Affected is an unknown function of the file /sysmanage/licence.php. The manipulation of the argument file_upload leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-241644. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

13 Oct 2023, 18:11

Type Values Removed Values Added
CPE cpe:2.3:o:byzoro:smart_s45f_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:byzoro:smart_s45f:-:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 8.8
First Time Byzoro
Byzoro smart S45f Firmware
Byzoro smart S45f
References (MISC) https://vuldb.com/?id.241644 - (MISC) https://vuldb.com/?id.241644 - Permissions Required, Third Party Advisory
References (MISC) https://vuldb.com/?ctiid.241644 - (MISC) https://vuldb.com/?ctiid.241644 - Third Party Advisory
References (MISC) https://github.com/llixixi/cve/blob/main/s45_upload_licence.md - (MISC) https://github.com/llixixi/cve/blob/main/s45_upload_licence.md - Exploit, Third Party Advisory

10 Oct 2023, 16:37

Type Values Removed Values Added
New CVE

Information

Published : 2023-10-10 16:15

Updated : 2024-05-17 02:33


NVD link : CVE-2023-5492

Mitre link : CVE-2023-5492

CVE.ORG link : CVE-2023-5492


JSON object : View

Products Affected

byzoro

  • smart_s45f_firmware
  • smart_s45f
CWE
CWE-434

Unrestricted Upload of File with Dangerous Type