CVE-2023-22586 - OpenCVE

The Danfoss AK-EM100 web applications allow for Local File Inclusion in the file parameter.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Danfoss	Ak-em100 Ak-em100 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:danfoss:ak-em100_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:danfoss:ak-em100:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://csirt.divd.nl/DIVD-2023-00021
https://divd.nl/cves/CVE-2023-22586

History

No history.

MITRE

Status: PUBLISHED

Assigner: DIVD

Published: 2023-06-11T13:17:01.615Z

Updated: 2024-08-06T12:32:35.540Z

Reserved: 2023-01-03T07:33:48.702Z

Link: CVE-2023-22586

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2023-06-11T14:15:09.853

Modified: 2023-06-16T03:50:40.117

Link: CVE-2023-22586

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-22586", "assignerOrgId": "b87402ff-ae37-4194-9dae-31abdbd6f217", "state": "PUBLISHED", "assignerShortName": "DIVD", "dateReserved": "2023-01-03T07:33:48.702Z", "datePublished": "2023-06-11T13:17:01.615Z", "dateUpdated": "2024-08-06T12:32:35.540Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "AK-EM100", "vendor": "Danfoss", "versions": [{"status": "affected", "version": "< 2.2.0.12"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Jony Schats (Hackdefense)"}, {"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Stan Plasmeijer (Hackdefense)"}, {"lang": "en", "type": "analyst", "user": "00000000-0000-4000-9000-000000000000", "value": "Max van der Horst (DIVD)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The Danfoss AK-EM100 web applications allow for Local File Inclusion in the file parameter."}], "value": "The Danfoss AK-EM100 web applications allow for Local File Inclusion in the file parameter."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "b87402ff-ae37-4194-9dae-31abdbd6f217", "shortName": "DIVD", "dateUpdated": "2024-08-06T12:32:35.540Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://divd.nl/cves/CVE-2023-22586"}, {"tags": ["third-party-advisory"], "url": "https://csirt.divd.nl/DIVD-2023-00021"}], "source": {"discovery": "EXTERNAL"}, "title": "Local File Inclusion in Danfoss AK-EM100", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The AK-EM100 has been declared End of Life (EOL). Danfoss advises phasing out this type of device."}], "value": "The AK-EM100 has been declared End of Life (EOL). Danfoss advises phasing out this type of device."}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:13:49.091Z"}, "title": "CVE Program Container", "references": [{"url": "https://divd.nl/cves/CVE-2023-22586", "tags": ["third-party-advisory", "x_transferred"]}, {"url": "https://csirt.divd.nl/DIVD-2023-00021", "tags": ["third-party-advisory", "x_transferred"]}]}]}}