CVEvulnerability
CVE-2023-0956
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2023-08-03
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-22
Description
External input could be used on TEL-STER TelWin SCADA WebInterface to construct paths to files and directories without properly neutralizing special elements within the pathname, which could allow an unauthenticated attacker to read files on the system.
Affected configurations
• tel-ster telwin scada webinterface (>= 3.2 < 6.2)
• tel-ster telwin scada webinterface (>= 7.0 < 7.2)
• tel-ster telwin scada webinterface 8.0
• tel-ster telwin scada webinterface 9.0
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://cert.pl/posts/2023/07/CVE-2023-0956/ Third Party Advisory
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-215-03 Third Party Advisory, US Government Resource
- https://www.tel-ster.pl/index.php/telwin-scada/nowosci/372-telwin-scada-podatnosc-cve-2023-0956 Vendor Advisory
- https://cert.pl/posts/2023/07/CVE-2023-0956/ Third Party Advisory
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-215-03 Third Party Advisory, US Government Resource
- https://www.tel-ster.pl/index.php/telwin-scada/nowosci/372-telwin-scada-podatnosc-cve-2023-0956 Vendor Advisory