« Volver al listado

CVE-2023-1731

Estado: ModificadaAlta (7.2)—

In Meinbergs LTOS versions prior to V7.06.013, the configuration file upload function would not correctly validate the input, which would allow an remote authenticated attacker with high privileges to execute arbitrary commands.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Meinbergglobal — Lantime Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-1731",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-1731",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-04T19:16:33.062158Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "info@cert.vde.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "info@cert.vde.com",
      "affectedData": [
        {
          "vendor": "Meinberg",
          "product": "LTOS",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "7.06.013",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-04-24T14:15:07.640",
  "references": [
    {
      "url": "https://www.meinbergglobal.com/english/news/meinberg-security-advisory-mbgsa-2023-02-lantime-firmware-v7-06-013.htm",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "info@cert.vde.com"
    },
    {
      "url": "https://www.meinbergglobal.com/english/news/meinberg-security-advisory-mbgsa-2023-02-lantime-firmware-v7-06-013.htm",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "info@cert.vde.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Meinbergs LTOS versions prior to V7.06.013, the configuration file upload function would not correctly validate the input, which would allow an remote authenticated attacker with high privileges to execute arbitrary commands.\n"
    }
  ],
  "lastModified": "2026-06-17T05:28:38.043",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:meinbergglobal:lantime_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8085F2DD-CD93-4D37-9567-62966EB45A12",
              "versionEndExcluding": "7.06.013"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:meinbergglobal:lantime_m100:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "2541CE93-F4C4-453E-83AC-ED39D83571DF"
            },
            {
              "criteria": "cpe:2.3:h:meinbergglobal:lantime_m200:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A0C58392-64BE-4A64-9B43-F599D03CBD3E"
            },
            {
              "criteria": "cpe:2.3:h:meinbergglobal:lantime_m300:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "D5FCA50A-2C6A-41ED-8E9D-38BA52C8428B"
            },
            {
              "criteria": "cpe:2.3:h:meinbergglobal:lantime_m400:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "51E5EFBE-3C3F-4386-A469-E190611A5A34"
            },
            {
              "criteria": "cpe:2.3:h:meinbergglobal:lantime_m600:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "46F4C7AA-30BB-402B-A21C-6FEEC919853C"
            },
            {
              "criteria": "cpe:2.3:h:meinbergglobal:lantime_m900:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "164CB3CF-F979-4591-8DF8-972123E216B0"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "info@cert.vde.com"
}