SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2023-5142

A vulnerability classified as problematic was found in H3C GR-1100-P, GR-1108-P, GR-1200W, GR-1800AX, GR-2200, GR-3200, GR-5200, GR-8300, ER2100n, ER2200G2, ER3200G2, ER3260G2, ER5100G2, ER5200G2 and ER6300G2 up to 20230908.

MEDIUM 5.3EPSS 2.32%

Does this matter?

Lower severity and a low EPSS score (2.32%). Track it; it rarely justifies an emergency change on its own.

Description

A vulnerability classified as problematic was found in H3C GR-1100-P, GR-1108-P, GR-1200W, GR-1800AX, GR-2200, GR-3200, GR-5200, GR-8300, ER2100n, ER2200G2, ER3200G2, ER3260G2, ER5100G2, ER5200G2 and ER6300G2 up to 20230908. This vulnerability affects unknown code of the file /userLogin.asp of the component Config File Handler. The manipulation leads to path traversal. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-240238 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1
5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS
2.32% probability · 82th percentile
CISA KEV
Not listed
Weakness
CWE-22
Affected
h3c/gr-1100-p firmware · h3c/gr-1108-p firmware · h3c/gr-1200w firmware · h3c/gr-1800ax firmware · h3c/gr-2200 firmware · h3c/gr-3200 firmware · h3c/gr-5200 firmware · h3c/gr-8300 firmware · h3c/er3260g2 firmware · h3c/er5200g2 firmware · h3c/er3200g2 firmware · h3c/er2100n firmware · h3c/er6300g2 firmware · h3c/er5100g2 firmware · h3c/er2200g2 firmware
Source
cna@vuldb.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.