CyberzSOC

Publication detail
← Back to advisories & guidance

ICSA-24-074-13: Softing edgeConnector ↗ source

March 14, 2024 CISA ICS Advisory
Source: https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-13

Summary

Successful exploitation of these vulnerabilities could create conditions that may allow remote code execution. CVE-2023-38126: The affected product is vulnerable to an absolute path traversal vulnerability, which may allow an attacker with admin privileges to write to a file or overwrite a file in the filesystem. CVE-2024-0860: The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker to capture packets to craft their own requests.

Advisory Details CISA ICS CSAF feed

Advisory ID
ICSA-24-074-13
Status
Final · version 1
Initial release
2024-03-14
Last revised
2024-03-14
Vendor
Softing
Critical infrastructure sectors
Critical Manufacturing
Deployed
Worldwide
Vendor headquarters
Germany

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

Credit: Claroty Team82; Trend Micro Zero Day Initiative; Pan ZhenPeng (@Peterpan0927), Li JianTao (@CurseRed) (STAR Labs SG Pte. Ltd. (@starlabs_sg))

Affected products (2)
  • edgeConnector — 3.60
  • edgeAggregator — 3.60

From CISA's machine-readable CSAF 2.0 advisory (JSON).

Vulnerabilities as Stated by the Advisory

CVEWeaknessCVSS v3Details
CVE-2024-0860 CWE-319 Cleartext Transmission of Sensitive Information 8.0 High The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker to capture packets to craft their own requests.

Vendor fix: Update Softing edgeConnector and edgeAggregator to v3.70 or greater.

Affected, fixed & timeline

Affected:

  • edgeConnector 3.60
  • edgeAggregator 3.60
CVE-2023-38126 CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 7.2 High The affected product is vulnerable to an absolute path traversal vulnerability, which may allow an attacker with admin privileges to write to a file or overwrite a file in the filesystem.

Vendor fix: Update Softing edgeConnector and edgeAggregator to v3.70 or greater.

Affected, fixed & timeline

Affected:

  • edgeConnector 3.60
  • edgeAggregator 3.60

Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVECVSSAffected
CVE-2024-0860 8.0 High Softing edgeConnector The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker to capture packet…
CVE-2023-38126 7.2 High Softing edgeAggregator Softing edgeAggregator Restore Configuration Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to e…

Named by the advisory itself. Each CVE links to its tracked detail page.

Vendors Named in This Publication

No KEV-catalogued vendors are named in this publication.