CVE-2017-20023

Published: Jun 9, 2022Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A vulnerability was found in Solare Solar-Log 2.8.4-56/3.5.2-85 and classified as critical. This issue affects some unknown processing of the component Network Config. The manipulation leads to privilege escalation. The attack may be initiated remotely. Upgrading to version 3.5.3-86 is able to address this issue. It is recommended to upgrade the affected component.

Affected (16)

Products: Solar Log: Solar Log 250 Firmware, Solar Log 300 Firmware, Solar Log 500 Firmware, Solar Log 800e Firmware, Solar Log 1000 Firmware, Solar Log 1000 Pm+ Firmware, Solar Log 1200 Firmware, Solar Log 2000 Firmware

Solar Log

8 products

Solar Log 250 Firmware

Solar Log 300 Firmware

Solar Log 500 Firmware

Solar Log 800e Firmware

Solar Log 1000 Firmware

Solar Log 1000 Pm+ Firmware

Solar Log 1200 Firmware

Solar Log 2000 Firmware

Configuration A

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Solar Log Solar Log 250 Firmware	Version 2.8.4-56
Solar Log Solar Log 250 Firmware	Version 3.5.2-85

Running on/with	Platform Versions
Solar Log Solar Log 250	All versions

Configuration B

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Solar Log Solar Log 300 Firmware	Version 2.8.4-56
Solar Log Solar Log 300 Firmware	Version 3.5.2-85

Running on/with	Platform Versions
Solar Log Solar Log 300	All versions

Configuration C

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Solar Log Solar Log 500 Firmware	Version 2.8.4-56
Solar Log Solar Log 500 Firmware	Version 3.5.2-85

Running on/with	Platform Versions
Solar Log Solar Log 500	All versions

Configuration D

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Solar Log Solar Log 800e Firmware	Version 2.8.4-56
Solar Log Solar Log 800e Firmware	Version 3.5.2-85

Running on/with	Platform Versions
Solar Log Solar Log 800e	All versions

Configuration E

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Solar Log Solar Log 1000 Firmware	Version 2.8.4-56
Solar Log Solar Log 1000 Firmware	Version 3.5.2-85

Running on/with	Platform Versions
Solar Log Solar Log 1000	All versions

Configuration F

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Solar Log Solar Log 1000 Pm+ Firmware	Version 2.8.4-56
Solar Log Solar Log 1000 Pm+ Firmware	Version 3.5.2-85

Running on/with	Platform Versions
Solar Log Solar Log 1000 Pm+	All versions

Configuration G

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Solar Log Solar Log 1200 Firmware	Version 2.8.4-56
Solar Log Solar Log 1200 Firmware	Version 3.5.2-85

Running on/with	Platform Versions
Solar Log Solar Log 1200	All versions

Configuration H

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Solar Log Solar Log 2000 Firmware	Version 2.8.4-56
Solar Log Solar Log 2000 Firmware	Version 3.5.2-85

Running on/with	Platform Versions
Solar Log Solar Log 2000	All versions

Related CWEs

CWE-269

Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

References (4)

http://seclists.org/fulldisclosure/2017/Mar/58

Source: cna@vuldb.com

ExploitMailing ListThird Party Advisory

https://vuldb.com/?id.98933

Source: cna@vuldb.com

Third Party Advisory

http://seclists.org/fulldisclosure/2017/Mar/58

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitMailing ListThird Party Advisory

https://vuldb.com/?id.98933

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.