Описание
E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can access any file from the E3 file system.
Затрагиваемое ПО
Copeland E3 supervisory controller firmwareCopeland Site supervisor bx 860-1240Copeland Site supervisor bxe 860-1245Copeland Site supervisor cx 860-1260Copeland Site supervisor cxe 860-1265Copeland Site supervisor rx 860-1220Copeland Site supervisor rxe 860-1225Copeland Site supervisor sf 860-1200
CVSS
| Балл | 7.5 — высокая |
| Вектор | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Источники
https://www.armis.com/research/frostbyte10/