1. EXECUTIVE SUMMARY
- CVSS v4 7.1
- ATTENTION: low attack complexity/public exploits are available
- Vendor: Deep Sea Electronics
- Equipment: DSE855
- Vulnerability: Missing Authentication for Critical Function
2. RISK EVALUATION
Successful exploitation of this vulnerability could allow an attacker to access stored credentials.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following versions of Deep Sea Electronics DSE855, an ethernet communications device, are affected:
- DSE855: Version 1.0.26
3.2 Vulnerability Overview
3.2.1 Missing Authentication for Critical Function CWE-306
Deep Sea Electronics DSE855 is vulnerable to a configuration disclosure when direct object reference is made to the Backup.bin file using an HTTP GET request.
CVE-2024-5947 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.5 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
A CVSS v4 score has also been calculated for CVE-2024-5947. A base score of 7.1 has been calculated; the CVSS vector string is (CVSS4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N).
3.3 BACKGROUND
- CRITICAL INFRASTRUCTURE SECTORS: Energy
- COUNTRIES/AREAS DEPLOYED: Worldwide
- COMPANY HEADQUARTERS LOCATION: United Kingdom
3.4 RESEARCHER
CISA discovered this vulnerability auth
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.
Read the original article: