CVE-2023-4739

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-4739
A vulnerability, which was classified as critical, has been found in Byzoro Smart S85F Management Platform up to 20230820. Affected by this issue is some unknown functionality of the file /sysmanage/updateos.php. The manipulation of the argument 1_file_upload leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238628. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://github.com/Meizhi-hua/cve/blob/main/upload_file.md Exploit
https://vuldb.com/?ctiid.238628 Permissions Required Third Party Advisory VDB Entry
https://vuldb.com/?id.238628 Permissions Required Third Party Advisory VDB Entry
https://vuldb.com/?submit.197572
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:byzoro:smart_s85f_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:byzoro:smart_s85f:-:*:*:*:*:*:*:*
History

09 Apr 2024, 09:15

Type Values Removed Values Added
Summary (en) A vulnerability, which was classified as critical, has been found in Beijing Baichuo Smart S85F Management Platform up to 20230820 on Smart. Affected by this issue is some unknown functionality of the file /sysmanage/updateos.php. The manipulation of the argument 1_file_upload leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238628. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. (en) A vulnerability, which was classified as critical, has been found in Byzoro Smart S85F Management Platform up to 20230820. Affected by this issue is some unknown functionality of the file /sysmanage/updateos.php. The manipulation of the argument 1_file_upload leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238628. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
References
  • () https://vuldb.com/?submit.197572 -

11 Sep 2023, 17:58

Type Values Removed Values Added
First Time Byzoro smart S85f
Byzoro smart S85f Firmware
CPE cpe:2.3:a:byzoro:smart_s85f_management_platform:*:*:*:*:*:*:*:* cpe:2.3:o:byzoro:smart_s85f_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:byzoro:smart_s85f:-:*:*:*:*:*:*:*

08 Sep 2023, 16:03

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
First Time Byzoro smart S85f Management Platform
Byzoro
References (MISC) https://github.com/Meizhi-hua/cve/blob/main/upload_file.md - (MISC) https://github.com/Meizhi-hua/cve/blob/main/upload_file.md - Exploit
References (MISC) https://vuldb.com/?ctiid.238628 - (MISC) https://vuldb.com/?ctiid.238628 - Permissions Required, Third Party Advisory, VDB Entry
References (MISC) https://vuldb.com/?id.238628 - (MISC) https://vuldb.com/?id.238628 - Permissions Required, Third Party Advisory, VDB Entry
CPE cpe:2.3:a:byzoro:smart_s85f_management_platform:*:*:*:*:*:*:*:*

03 Sep 2023, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-09-03 20:15

Updated : 2024-04-11 01:22

NVD link : CVE-2023-4739

Mitre link : CVE-2023-4739

CVE.ORG link : CVE-2023-4739

JSON object : View

Products Affected

byzoro

  • smart_s85f_firmware
  • smart_s85f
CWE
CWE-434

Unrestricted Upload of File with Dangerous Type