CVE-2023-43271 - Vulnerability Details - OpenCVE

Incorrect access control in 70mai a500s v1.2.119 allows attackers to directly access and delete the video files of the driving recorder through ftp and other protocols.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
70mai	A500s A500s Firmware

Configuration 1 [-]

AND

cpe:2.3:o:70mai:a500s_firmware:1.2.119:*:*:*:*:*:*:*

cpe:2.3:h:70mai:a500s:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/Question-h/vuln/blob/master/70mai_a500s_backdoor.md
https://github.com/Question-h/vuln/blob/master/CVE-2023-43271.md

History

Thu, 19 Sep 2024 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-10-09T00:00:00

Updated: 2024-09-19T15:54:40.735Z

Reserved: 2023-09-18T00:00:00

Link: CVE-2023-43271

Vulnrichment

Updated: 2024-08-02T19:37:23.487Z

NVD

Status : Modified

Published: 2023-10-09T21:15:10.173

Modified: 2024-11-21T08:23:55.277

Link: CVE-2023-43271

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:70mai:a500s_firmware:1.2.119:*:*:*:*:*:*:*", "matchCriteriaId": "B2121501-D225-45EE-90EC-E949D26E2820", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:70mai:a500s:-:*:*:*:*:*:*:*", "matchCriteriaId": "C401CE32-74F5-4E1E-BB81-D286F0AE26E5", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Incorrect access control in 70mai a500s v1.2.119 allows attackers to directly access and delete the video files of the driving recorder through ftp and other protocols."}, {"lang": "es", "value": "El control de acceso incorrecto en 70mai a500s v1.2.119 permite a los atacantes acceder y eliminar directamente los archivos de v\u00eddeo de la grabadora de conducci\u00f3n a trav\u00e9s de ftp y otros protocolos."}], "id": "CVE-2023-43271", "lastModified": "2024-11-21T08:23:55.277", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-10-09T21:15:10.173", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/Question-h/vuln/blob/master/70mai_a500s_backdoor.md"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://github.com/Question-h/vuln/blob/master/CVE-2023-43271.md"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/Question-h/vuln/blob/master/70mai_a500s_backdoor.md"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/Question-h/vuln/blob/master/CVE-2023-43271.md"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "nvd@nist.gov", "type": "Primary"}]}