Search criteria
6 vulnerabilities found for Smart S150 Management Platform by Byzoro
CVE-2024-0716 (GCVE-0-2024-0716)
Vulnerability from cvelistv5 – Published: 2024-01-19 15:00 – Updated: 2024-10-21 11:31
VLAI?
Title
Byzoro Smart S150 Management Platform Backup File download.php information disclosure
Summary
A vulnerability classified as problematic has been found in Byzoro Smart S150 Management Platform V31R02B15. This affects an unknown part of the file /log/download.php of the component Backup File Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-251541 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Severity ?
CWE
- CWE-200 - Information Disclosure
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Byzoro | Smart S150 Management Platform |
Affected:
V31R02B15
|
Credits
rollingchair (VulDB User)
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T18:11:35.779Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VDB-251541 | Byzoro Smart S150 Management Platform Backup File download.php information disclosure",
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.251541"
},
{
"name": "VDB-251541 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.251541"
},
{
"name": "Submit #265177 | \u5317\u4eac\u767e\u5353\u7f51\u7edc\u6280\u672f\u6709\u9650\u516c\u53f8 Smart S150 Smart V31R02B15 Download any file",
"tags": [
"third-party-advisory",
"x_transferred"
],
"url": "https://vuldb.com/?submit.265177"
},
{
"tags": [
"exploit",
"x_transferred"
],
"url": "https://github.com/GTA12138/vul/blob/main/smart%20s150/s150%20Download%20any%20file/smart%20s150%20download%20any%20file.md"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:byzoro:smart_s150:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "smart_s150",
"vendor": "byzoro",
"versions": [
{
"status": "affected",
"version": "V31R02B15"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-0716",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-01-22T15:24:13.454422Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532 Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-21T11:31:56.228Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Backup File Handler"
],
"product": "Smart S150 Management Platform",
"vendor": "Byzoro",
"versions": [
{
"status": "affected",
"version": "V31R02B15"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "rollingchair (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability classified as problematic has been found in Byzoro Smart S150 Management Platform V31R02B15. This affects an unknown part of the file /log/download.php of the component Backup File Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-251541 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Es wurde eine Schwachstelle in Byzoro Smart S150 Management Platform V31R02B15 entdeckt. Sie wurde als problematisch eingestuft. Hiervon betroffen ist ein unbekannter Codeblock der Datei /log/download.php der Komponente Backup File Handler. Durch Manipulation mit unbekannten Daten kann eine information disclosure-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Die Komplexit\u00e4t eines Angriffs ist eher hoch. Sie ist schwierig auszunutzen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.1,
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-09T08:34:26.803Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-251541 | Byzoro Smart S150 Management Platform Backup File download.php information disclosure",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.251541"
},
{
"name": "VDB-251541 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.251541"
},
{
"name": "Submit #265177 | \u5317\u4eac\u767e\u5353\u7f51\u7edc\u6280\u672f\u6709\u9650\u516c\u53f8 Smart S150 Smart V31R02B15 Download any file",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.265177"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/GTA12138/vul/blob/main/smart%20s150/s150%20Download%20any%20file/smart%20s150%20download%20any%20file.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-01-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2024-01-19T00:00:00.000Z",
"value": "CVE reserved"
},
{
"lang": "en",
"time": "2024-01-19T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2024-04-09T09:07:14.000Z",
"value": "VulDB entry last update"
}
],
"title": "Byzoro Smart S150 Management Platform Backup File download.php information disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-0716",
"datePublished": "2024-01-19T15:00:05.792Z",
"dateReserved": "2024-01-19T07:10:13.648Z",
"dateUpdated": "2024-10-21T11:31:56.228Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-0712 (GCVE-0-2024-0712)
Vulnerability from cvelistv5 – Published: 2024-01-19 13:31 – Updated: 2024-08-26 18:21
VLAI?
Title
Byzoro Smart S150 Management Platform userattea.php access control
Summary
A vulnerability was found in Byzoro Smart S150 Management Platform V31R02B15. It has been classified as critical. Affected is an unknown function of the file /useratte/inc/userattea.php. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-251538 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Severity ?
7.3 (High)
7.3 (High)
CWE
- CWE-284 - Improper Access Controls
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Byzoro | Smart S150 Management Platform |
Affected:
V31R02B15
|
Credits
rollingchair (VulDB User)
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T18:11:35.717Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VDB-251538 | Byzoro Smart S150 Management Platform userattea.php access control",
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.251538"
},
{
"name": "VDB-251538 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.251538"
},
{
"name": "Submit #264497 | \u5317\u4eac\u767e\u5353\u7f51\u7edc\u6280\u672f\u6709\u9650\u516c\u53f8 Smart S150 S150 unauthorized",
"tags": [
"third-party-advisory",
"x_transferred"
],
"url": "https://vuldb.com/?submit.264497"
},
{
"tags": [
"exploit",
"x_transferred"
],
"url": "https://github.com/GTA12138/vul/blob/main/smart%20s150/2024-1-9%20smart%20s150%20101508.md"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:byzoro:smart_s150_firmware:31r02b15:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "smart_s150_firmware",
"vendor": "byzoro",
"versions": [
{
"status": "affected",
"version": "31r02b15"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-0712",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-26T18:11:52.888478Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-26T18:21:22.473Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Smart S150 Management Platform",
"vendor": "Byzoro",
"versions": [
{
"status": "affected",
"version": "V31R02B15"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "rollingchair (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Byzoro Smart S150 Management Platform V31R02B15. It has been classified as critical. Affected is an unknown function of the file /useratte/inc/userattea.php. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-251538 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Es wurde eine kritische Schwachstelle in Byzoro Smart S150 Management Platform V31R02B15 ausgemacht. Dabei betrifft es einen unbekannter Codeteil der Datei /useratte/inc/userattea.php. Dank Manipulation mit unbekannten Daten kann eine improper access controls-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-09T08:34:14.487Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-251538 | Byzoro Smart S150 Management Platform userattea.php access control",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.251538"
},
{
"name": "VDB-251538 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.251538"
},
{
"name": "Submit #264497 | \u5317\u4eac\u767e\u5353\u7f51\u7edc\u6280\u672f\u6709\u9650\u516c\u53f8 Smart S150 S150 unauthorized",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.264497"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/GTA12138/vul/blob/main/smart%20s150/2024-1-9%20smart%20s150%20101508.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-01-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2024-01-19T00:00:00.000Z",
"value": "CVE reserved"
},
{
"lang": "en",
"time": "2024-01-19T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2024-04-09T09:07:12.000Z",
"value": "VulDB entry last update"
}
],
"title": "Byzoro Smart S150 Management Platform userattea.php access control"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-0712",
"datePublished": "2024-01-19T13:31:04.512Z",
"dateReserved": "2024-01-19T06:46:15.553Z",
"dateUpdated": "2024-08-26T18:21:22.473Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-0300 (GCVE-0-2024-0300)
Vulnerability from cvelistv5 – Published: 2024-01-08 06:00 – Updated: 2024-09-04 19:16
VLAI?
Title
Byzoro Smart S150 Management Platform HTTP POST Request userattestation.php unrestricted upload
Summary
A vulnerability was found in Byzoro Smart S150 Management Platform up to 20240101. It has been rated as critical. Affected by this issue is some unknown functionality of the file /useratte/userattestation.php of the component HTTP POST Request Handler. The manipulation of the argument web_img leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249866 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Severity ?
6.3 (Medium)
6.3 (Medium)
CWE
- CWE-434 - Unrestricted Upload
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Byzoro | Smart S150 Management Platform |
Affected:
20240101
|
Credits
Tomasn (VulDB User)
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T18:04:48.491Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VDB-249866 | Byzoro Smart S150 Management Platform HTTP POST Request userattestation.php unrestricted upload",
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.249866"
},
{
"name": "VDB-249866 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.249866"
},
{
"name": "Submit #260962 | Beijing Baizhuo Network Technology Co., LTD Smart S150 management platform S150 files upload",
"tags": [
"third-party-advisory",
"x_transferred"
],
"url": "https://vuldb.com/?submit.260962"
},
{
"tags": [
"exploit",
"x_transferred"
],
"url": "https://github.com/tolkent/cve/blob/main/upload.md"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:byzoro:smart_s150_firmware:2024-01-01:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "smart_s150_firmware",
"vendor": "byzoro",
"versions": [
{
"status": "affected",
"version": "2024-01-01"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-0300",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-03-13T19:26:39.277374Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-04T19:16:07.984Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"HTTP POST Request Handler"
],
"product": "Smart S150 Management Platform",
"vendor": "Byzoro",
"versions": [
{
"status": "affected",
"version": "20240101"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Tomasn (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Byzoro Smart S150 Management Platform up to 20240101. It has been rated as critical. Affected by this issue is some unknown functionality of the file /useratte/userattestation.php of the component HTTP POST Request Handler. The manipulation of the argument web_img leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249866 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Eine kritische Schwachstelle wurde in Byzoro Smart S150 Management Platform bis 20240101 ausgemacht. Es geht hierbei um eine nicht n\u00e4her spezifizierte Funktion der Datei /useratte/userattestation.php der Komponente HTTP POST Request Handler. Dank Manipulation des Arguments web_img mit unbekannten Daten kann eine unrestricted upload-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-09T08:35:05.139Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-249866 | Byzoro Smart S150 Management Platform HTTP POST Request userattestation.php unrestricted upload",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.249866"
},
{
"name": "VDB-249866 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.249866"
},
{
"name": "Submit #260962 | Beijing Baizhuo Network Technology Co., LTD Smart S150 management platform S150 files upload",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.260962"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/tolkent/cve/blob/main/upload.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-01-07T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2024-01-07T00:00:00.000Z",
"value": "CVE reserved"
},
{
"lang": "en",
"time": "2024-01-07T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2024-04-09T09:07:09.000Z",
"value": "VulDB entry last update"
}
],
"title": "Byzoro Smart S150 Management Platform HTTP POST Request userattestation.php unrestricted upload"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-0300",
"datePublished": "2024-01-08T06:00:04.028Z",
"dateReserved": "2024-01-07T09:18:20.758Z",
"dateUpdated": "2024-09-04T19:16:07.984Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-0716 (GCVE-0-2024-0716)
Vulnerability from nvd – Published: 2024-01-19 15:00 – Updated: 2024-10-21 11:31
VLAI?
Title
Byzoro Smart S150 Management Platform Backup File download.php information disclosure
Summary
A vulnerability classified as problematic has been found in Byzoro Smart S150 Management Platform V31R02B15. This affects an unknown part of the file /log/download.php of the component Backup File Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-251541 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Severity ?
CWE
- CWE-200 - Information Disclosure
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Byzoro | Smart S150 Management Platform |
Affected:
V31R02B15
|
Credits
rollingchair (VulDB User)
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T18:11:35.779Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VDB-251541 | Byzoro Smart S150 Management Platform Backup File download.php information disclosure",
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.251541"
},
{
"name": "VDB-251541 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.251541"
},
{
"name": "Submit #265177 | \u5317\u4eac\u767e\u5353\u7f51\u7edc\u6280\u672f\u6709\u9650\u516c\u53f8 Smart S150 Smart V31R02B15 Download any file",
"tags": [
"third-party-advisory",
"x_transferred"
],
"url": "https://vuldb.com/?submit.265177"
},
{
"tags": [
"exploit",
"x_transferred"
],
"url": "https://github.com/GTA12138/vul/blob/main/smart%20s150/s150%20Download%20any%20file/smart%20s150%20download%20any%20file.md"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:byzoro:smart_s150:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "smart_s150",
"vendor": "byzoro",
"versions": [
{
"status": "affected",
"version": "V31R02B15"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-0716",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-01-22T15:24:13.454422Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532 Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-21T11:31:56.228Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Backup File Handler"
],
"product": "Smart S150 Management Platform",
"vendor": "Byzoro",
"versions": [
{
"status": "affected",
"version": "V31R02B15"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "rollingchair (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability classified as problematic has been found in Byzoro Smart S150 Management Platform V31R02B15. This affects an unknown part of the file /log/download.php of the component Backup File Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-251541 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Es wurde eine Schwachstelle in Byzoro Smart S150 Management Platform V31R02B15 entdeckt. Sie wurde als problematisch eingestuft. Hiervon betroffen ist ein unbekannter Codeblock der Datei /log/download.php der Komponente Backup File Handler. Durch Manipulation mit unbekannten Daten kann eine information disclosure-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Die Komplexit\u00e4t eines Angriffs ist eher hoch. Sie ist schwierig auszunutzen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.1,
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-09T08:34:26.803Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-251541 | Byzoro Smart S150 Management Platform Backup File download.php information disclosure",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.251541"
},
{
"name": "VDB-251541 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.251541"
},
{
"name": "Submit #265177 | \u5317\u4eac\u767e\u5353\u7f51\u7edc\u6280\u672f\u6709\u9650\u516c\u53f8 Smart S150 Smart V31R02B15 Download any file",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.265177"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/GTA12138/vul/blob/main/smart%20s150/s150%20Download%20any%20file/smart%20s150%20download%20any%20file.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-01-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2024-01-19T00:00:00.000Z",
"value": "CVE reserved"
},
{
"lang": "en",
"time": "2024-01-19T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2024-04-09T09:07:14.000Z",
"value": "VulDB entry last update"
}
],
"title": "Byzoro Smart S150 Management Platform Backup File download.php information disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-0716",
"datePublished": "2024-01-19T15:00:05.792Z",
"dateReserved": "2024-01-19T07:10:13.648Z",
"dateUpdated": "2024-10-21T11:31:56.228Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-0712 (GCVE-0-2024-0712)
Vulnerability from nvd – Published: 2024-01-19 13:31 – Updated: 2024-08-26 18:21
VLAI?
Title
Byzoro Smart S150 Management Platform userattea.php access control
Summary
A vulnerability was found in Byzoro Smart S150 Management Platform V31R02B15. It has been classified as critical. Affected is an unknown function of the file /useratte/inc/userattea.php. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-251538 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Severity ?
7.3 (High)
7.3 (High)
CWE
- CWE-284 - Improper Access Controls
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Byzoro | Smart S150 Management Platform |
Affected:
V31R02B15
|
Credits
rollingchair (VulDB User)
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T18:11:35.717Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VDB-251538 | Byzoro Smart S150 Management Platform userattea.php access control",
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.251538"
},
{
"name": "VDB-251538 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.251538"
},
{
"name": "Submit #264497 | \u5317\u4eac\u767e\u5353\u7f51\u7edc\u6280\u672f\u6709\u9650\u516c\u53f8 Smart S150 S150 unauthorized",
"tags": [
"third-party-advisory",
"x_transferred"
],
"url": "https://vuldb.com/?submit.264497"
},
{
"tags": [
"exploit",
"x_transferred"
],
"url": "https://github.com/GTA12138/vul/blob/main/smart%20s150/2024-1-9%20smart%20s150%20101508.md"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:byzoro:smart_s150_firmware:31r02b15:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "smart_s150_firmware",
"vendor": "byzoro",
"versions": [
{
"status": "affected",
"version": "31r02b15"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-0712",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-26T18:11:52.888478Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-26T18:21:22.473Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Smart S150 Management Platform",
"vendor": "Byzoro",
"versions": [
{
"status": "affected",
"version": "V31R02B15"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "rollingchair (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Byzoro Smart S150 Management Platform V31R02B15. It has been classified as critical. Affected is an unknown function of the file /useratte/inc/userattea.php. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-251538 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Es wurde eine kritische Schwachstelle in Byzoro Smart S150 Management Platform V31R02B15 ausgemacht. Dabei betrifft es einen unbekannter Codeteil der Datei /useratte/inc/userattea.php. Dank Manipulation mit unbekannten Daten kann eine improper access controls-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-09T08:34:14.487Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-251538 | Byzoro Smart S150 Management Platform userattea.php access control",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.251538"
},
{
"name": "VDB-251538 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.251538"
},
{
"name": "Submit #264497 | \u5317\u4eac\u767e\u5353\u7f51\u7edc\u6280\u672f\u6709\u9650\u516c\u53f8 Smart S150 S150 unauthorized",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.264497"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/GTA12138/vul/blob/main/smart%20s150/2024-1-9%20smart%20s150%20101508.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-01-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2024-01-19T00:00:00.000Z",
"value": "CVE reserved"
},
{
"lang": "en",
"time": "2024-01-19T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2024-04-09T09:07:12.000Z",
"value": "VulDB entry last update"
}
],
"title": "Byzoro Smart S150 Management Platform userattea.php access control"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-0712",
"datePublished": "2024-01-19T13:31:04.512Z",
"dateReserved": "2024-01-19T06:46:15.553Z",
"dateUpdated": "2024-08-26T18:21:22.473Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-0300 (GCVE-0-2024-0300)
Vulnerability from nvd – Published: 2024-01-08 06:00 – Updated: 2024-09-04 19:16
VLAI?
Title
Byzoro Smart S150 Management Platform HTTP POST Request userattestation.php unrestricted upload
Summary
A vulnerability was found in Byzoro Smart S150 Management Platform up to 20240101. It has been rated as critical. Affected by this issue is some unknown functionality of the file /useratte/userattestation.php of the component HTTP POST Request Handler. The manipulation of the argument web_img leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249866 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Severity ?
6.3 (Medium)
6.3 (Medium)
CWE
- CWE-434 - Unrestricted Upload
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Byzoro | Smart S150 Management Platform |
Affected:
20240101
|
Credits
Tomasn (VulDB User)
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T18:04:48.491Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VDB-249866 | Byzoro Smart S150 Management Platform HTTP POST Request userattestation.php unrestricted upload",
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.249866"
},
{
"name": "VDB-249866 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.249866"
},
{
"name": "Submit #260962 | Beijing Baizhuo Network Technology Co., LTD Smart S150 management platform S150 files upload",
"tags": [
"third-party-advisory",
"x_transferred"
],
"url": "https://vuldb.com/?submit.260962"
},
{
"tags": [
"exploit",
"x_transferred"
],
"url": "https://github.com/tolkent/cve/blob/main/upload.md"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:byzoro:smart_s150_firmware:2024-01-01:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "smart_s150_firmware",
"vendor": "byzoro",
"versions": [
{
"status": "affected",
"version": "2024-01-01"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-0300",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-03-13T19:26:39.277374Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-04T19:16:07.984Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"HTTP POST Request Handler"
],
"product": "Smart S150 Management Platform",
"vendor": "Byzoro",
"versions": [
{
"status": "affected",
"version": "20240101"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Tomasn (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Byzoro Smart S150 Management Platform up to 20240101. It has been rated as critical. Affected by this issue is some unknown functionality of the file /useratte/userattestation.php of the component HTTP POST Request Handler. The manipulation of the argument web_img leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249866 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Eine kritische Schwachstelle wurde in Byzoro Smart S150 Management Platform bis 20240101 ausgemacht. Es geht hierbei um eine nicht n\u00e4her spezifizierte Funktion der Datei /useratte/userattestation.php der Komponente HTTP POST Request Handler. Dank Manipulation des Arguments web_img mit unbekannten Daten kann eine unrestricted upload-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-09T08:35:05.139Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-249866 | Byzoro Smart S150 Management Platform HTTP POST Request userattestation.php unrestricted upload",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.249866"
},
{
"name": "VDB-249866 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.249866"
},
{
"name": "Submit #260962 | Beijing Baizhuo Network Technology Co., LTD Smart S150 management platform S150 files upload",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.260962"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/tolkent/cve/blob/main/upload.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-01-07T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2024-01-07T00:00:00.000Z",
"value": "CVE reserved"
},
{
"lang": "en",
"time": "2024-01-07T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2024-04-09T09:07:09.000Z",
"value": "VulDB entry last update"
}
],
"title": "Byzoro Smart S150 Management Platform HTTP POST Request userattestation.php unrestricted upload"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-0300",
"datePublished": "2024-01-08T06:00:04.028Z",
"dateReserved": "2024-01-07T09:18:20.758Z",
"dateUpdated": "2024-09-04T19:16:07.984Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}