Sign-up

ID

VAR-202311-1677


CVE

CVE-2023-5299


TITLE

Fuji Electric's  Tellus Lite V-Simulator  Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2023-018322

DESCRIPTION

A user with a standard account in Fuji Electric Tellus Lite may overwrite files in the system. Fuji Electric's Tellus Lite V-Simulator Exists in unspecified vulnerabilities.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the product installer. The issue results from incorrect permissions set on product folders created by the installer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of any user of the software

Trust: 2.34

sources: NVD: CVE-2023-5299 // JVNDB: JVNDB-2023-018322 // ZDI: ZDI-23-1730 // VULMON: CVE-2023-5299

AFFECTED PRODUCTS

vendor:fujielectricmodel:tellus lite v-simulatorscope:ltversion:4.0.19.0

Trust: 1.0

vendor:富士電機model:tellus lite v-simulatorscope: - version: -

Trust: 0.8

vendor:富士電機model:tellus lite v-simulatorscope:eqversion: -

Trust: 0.8

vendor:富士電機model:tellus lite v-simulatorscope:eqversion:4.0.19.0

Trust: 0.8

vendor:fuji electricmodel:tellus litescope: - version: -

Trust: 0.7

sources: ZDI: ZDI-23-1730 // JVNDB: JVNDB-2023-018322 // NVD: CVE-2023-5299

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2023-5299
value: HIGH

Trust: 1.0

ics-cert@hq.dhs.gov: CVE-2023-5299
value: HIGH

Trust: 1.0

NVD: CVE-2023-5299
value: HIGH

Trust: 0.8

ZDI: CVE-2023-5299
value: HIGH

Trust: 0.7

nvd@nist.gov: CVE-2023-5299
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

ics-cert@hq.dhs.gov: CVE-2023-5299
baseSeverity: HIGH
baseScore: 7.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.3
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2023-5299
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2023-5299
baseSeverity: HIGH
baseScore: 7.3
vectorString: AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.3
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-23-1730 // JVNDB: JVNDB-2023-018322 // NVD: CVE-2023-5299 // NVD: CVE-2023-5299

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

problemtype:CWE-284

Trust: 1.0

problemtype:others (CWE-Other) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2023-018322 // NVD: CVE-2023-5299

PATCH

title:Fuji Electric has issued an update to correct this vulnerability.url:https://www.cisa.gov/news-events/ics-advisories/icsa-23-325-02

Trust: 0.7

sources: ZDI: ZDI-23-1730

EXTERNAL IDS

db:NVDid:CVE-2023-5299

Trust: 3.4

db:ICS CERTid:ICSA-23-325-02

Trust: 1.9

db:JVNid:JVNVU98886797

Trust: 0.8

db:JVNDBid:JVNDB-2023-018322

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-21224

Trust: 0.7

db:ZDIid:ZDI-23-1730

Trust: 0.7

db:VULMONid:CVE-2023-5299

Trust: 0.1

sources: ZDI: ZDI-23-1730 // VULMON: CVE-2023-5299 // JVNDB: JVNDB-2023-018322 // NVD: CVE-2023-5299

REFERENCES

url:https://www.cisa.gov/news-events/ics-advisories/icsa-23-325-02

Trust: 2.7

url:https://felib.fujielectric.co.jp/en/m10009/m20034/document_detail/c27d5b69-68ef-4af5-90ee-b5dab118f71a

Trust: 1.9

url:https://jvn.jp/vu/jvnvu98886797/

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2023-5299

Trust: 0.8

url:https://nvd.nist.gov

Trust: 0.1

sources: ZDI: ZDI-23-1730 // VULMON: CVE-2023-5299 // JVNDB: JVNDB-2023-018322 // NVD: CVE-2023-5299

CREDITS

Fritz Sands

Trust: 0.7

sources: ZDI: ZDI-23-1730

SOURCES

db:ZDIid:ZDI-23-1730
db:VULMONid:CVE-2023-5299
db:JVNDBid:JVNDB-2023-018322
db:NVDid:CVE-2023-5299

LAST UPDATE DATE

2024-09-05T23:05:54.909000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-23-1730date:2023-11-27T00:00:00
db:VULMONid:CVE-2023-5299date:2023-11-22T00:00:00
db:JVNDBid:JVNDB-2023-018322date:2024-01-11T02:33:00
db:NVDid:CVE-2023-5299date:2024-09-04T19:35:10.513

SOURCES RELEASE DATE

db:ZDIid:ZDI-23-1730date:2023-11-27T00:00:00
db:VULMONid:CVE-2023-5299date:2023-11-22T00:00:00
db:JVNDBid:JVNDB-2023-018322date:2024-01-11T00:00:00
db:NVDid:CVE-2023-5299date:2023-11-22T01:15:08.187