CVE-2024-23492 - Vulnerability Details - OpenCVE

A weak encoding is used to transmit credentials for WS203VICM.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://clibrary-online.commend.com/en/cyber-security/security-advisories.html
https://www.cisa.gov/news-events/ics-advisories/icsa-24-051-01

History

No history.

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2024-03-01T20:56:33.687Z

Updated: 2024-08-01T23:06:24.711Z

Reserved: 2024-01-30T22:06:32.532Z

Link: CVE-2024-23492

Vulnrichment

Updated: 2024-08-01T23:06:24.711Z

NVD

Status : Awaiting Analysis

Published: 2024-03-01T21:15:08.367

Modified: 2024-11-21T08:57:49.363

Link: CVE-2024-23492

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-23492", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2024-01-30T22:06:32.532Z", "datePublished": "2024-03-01T20:56:33.687Z", "dateUpdated": "2024-08-01T23:06:24.711Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "WS203VICM", "vendor": "Commend", "versions": [{"lessThanOrEqual": "1.7", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Aar\u00f3n Flecha Men\u00e9ndez of S21sec reported these vulnerabilities to CISA."}], "datePublic": "2024-02-20T20:48:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n\nA weak encoding is used to transmit credentials for WS203VICM.\n\n\n\n\n\n"}], "value": "\n\nA weak encoding is used to transmit credentials for WS203VICM.\n\n\n\n\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-261", "description": "CWE-261", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2024-03-01T20:56:33.687Z"}, "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-051-01"}, {"url": "https://clibrary-online.commend.com/en/cyber-security/security-advisories.html"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\nAlthough this is an end-of-life product, Commend has created new firmware <a target=\"_blank\" rel=\"nofollow\" href=\"https://clibrary-online.commend.com/\">version WS-CM 2.0</a> <span style=\"background-color: var(--wht);\"> to\n address the first two issues. The new firmware can be loaded via the \nprogram \"IP Station Config\". To install the firmware, follow the \ninstructions below:</span><ol>\n<li>Log in to the Commend web-portal.</li>\n<li>Download and extract the \"Terminals Software Package\".</li>\n<li>In \"IP Station Config\", select the stations to be updated in the table.</li>\n<li>Go to: Menu Station > Firmware Download</li>\n<li>Select the file \"WS-CM 2.0.geh\" from the folder \"WS-CM\" and click on the button Open.</li>\n</ol>\n<p>For additional information, please visit <a target=\"_blank\" rel=\"nofollow\" href=\"https://clibrary-online.commend.com/en/cyber-security/security-advisories.html\">CSA-2024-42 on Commend's cybersecurity website.</a></p>\n\n<br>"}], "value": "Although this is an end-of-life product, Commend has created new firmware version WS-CM 2.0 https://clibrary-online.commend.com/ \u00a0\u00a0to\n address the first two issues. The new firmware can be loaded via the \nprogram \"IP Station Config\". To install the firmware, follow the \ninstructions below:\n * Log in to the Commend web-portal.\n\n * Download and extract the \"Terminals Software Package\".\n\n * In \"IP Station Config\", select the stations to be updated in the table.\n\n * Go to: Menu Station > Firmware Download\n\n * Select the file \"WS-CM 2.0.geh\" from the folder \"WS-CM\" and click on the button Open.\n\n\nFor additional information, please visit CSA-2024-42 on Commend's cybersecurity website. https://clibrary-online.commend.com/en/cyber-security/security-advisories.html \n\n\n\n\n"}], "source": {"advisory": "ICSA-24-051-01", "discovery": "EXTERNAL"}, "tags": ["unsupported-when-assigned"], "title": "Commend WS203VICM Weak Encoding for Password", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-23492", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-06T16:57:15.113764Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T17:22:05.347Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:06:24.711Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-051-01", "tags": ["x_transferred"]}, {"url": "https://clibrary-online.commend.com/en/cyber-security/security-advisories.html", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-051-01", "tags": ["x_transferred"]}, {"url": "https://clibrary-online.commend.com/en/cyber-security/security-advisories.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:06:24.711Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-23492", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-06T16:57:15.113764Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T15:20:41.160Z"}}], "cna": {"tags": ["unsupported-when-assigned"], "title": "Commend WS203VICM Weak Encoding for Password", "source": {"advisory": "ICSA-24-051-01", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Aar\u00f3n Flecha Men\u00e9ndez of S21sec reported these vulnerabilities to CISA."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Commend", "product": "WS203VICM", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.7"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Although this is an end-of-life product, Commend has created new firmware version WS-CM 2.0 https://clibrary-online.commend.com/ \u00a0\u00a0to\n address the first two issues. The new firmware can be loaded via the \nprogram \"IP Station Config\". To install the firmware, follow the \ninstructions below:\n * Log in to the Commend web-portal.\n\n * Download and extract the \"Terminals Software Package\".\n\n * In \"IP Station Config\", select the stations to be updated in the table.\n\n * Go to: Menu Station > Firmware Download\n\n * Select the file \"WS-CM 2.0.geh\" from the folder \"WS-CM\" and click on the button Open.\n\n\nFor additional information, please visit CSA-2024-42 on Commend's cybersecurity website. https://clibrary-online.commend.com/en/cyber-security/security-advisories.html \n\n\n\n\n", "supportingMedia": [{"type": "text/html", "value": "\nAlthough this is an end-of-life product, Commend has created new firmware <a target=\"_blank\" rel=\"nofollow\" href=\"https://clibrary-online.commend.com/\">version WS-CM 2.0</a> <span style=\"background-color: var(--wht);\"> to\n address the first two issues. The new firmware can be loaded via the \nprogram \"IP Station Config\". To install the firmware, follow the \ninstructions below:</span><ol>\n<li>Log in to the Commend web-portal.</li>\n<li>Download and extract the \"Terminals Software Package\".</li>\n<li>In \"IP Station Config\", select the stations to be updated in the table.</li>\n<li>Go to: Menu Station > Firmware Download</li>\n<li>Select the file \"WS-CM 2.0.geh\" from the folder \"WS-CM\" and click on the button Open.</li>\n</ol>\n<p>For additional information, please visit <a target=\"_blank\" rel=\"nofollow\" href=\"https://clibrary-online.commend.com/en/cyber-security/security-advisories.html\">CSA-2024-42 on Commend's cybersecurity website.</a></p>\n\n<br>", "base64": false}]}], "datePublic": "2024-02-20T20:48:00.000Z", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-051-01"}, {"url": "https://clibrary-online.commend.com/en/cyber-security/security-advisories.html"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "\n\nA weak encoding is used to transmit credentials for WS203VICM.\n\n\n\n\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n\nA weak encoding is used to transmit credentials for WS203VICM.\n\n\n\n\n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-261", "description": "CWE-261"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2024-03-01T20:56:33.687Z"}}}, "cveMetadata": {"cveId": "CVE-2024-23492", "state": "PUBLISHED", "dateUpdated": "2024-08-01T23:06:24.711Z", "dateReserved": "2024-01-30T22:06:32.532Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2024-03-01T20:56:33.687Z", "assignerShortName": "icscert"}, "dataVersion": "5.1"}