Skip to content
OpenAdvisories
Critical ICSA-23-187-01 9 CVEs

PiiGAB M-Bus

Published Jul 6, 2023 · Updated Jul 6, 2023

Vendor: PiiGAB, Processinformation i G�teborg Aktiebolag Product: M-Bus SoftwarePack

Summary

Successful exploitation of these vulnerabilities could crash allow an attacker to inject arbitrary commands, steal passwords, or trick valid users into executing malicious commands.

Vulnerabilities 9

  • Critical 9.8
    CVE-2023-35987

    PiiGAB M-Bus Use of Hard-coded Credentials

    PiiGAB M-Bus contains hard-coded credentials which it uses for authentication.

    PiiGAB M-Bus SoftwarePack
  • High 8.8
    CVE-2023-35120

    PiiGAB M-Bus Cross-Site Request Forgery

    PiiGAB M-Bus is vulnerable to cross-site request forgery. An attacker who wants to execute a certain command could send a phishing mail to the owner of the device and hope that the owner clicks on the link. If the owner of the device has a cookie stored that …

    PiiGAB M-Bus SoftwarePack
  • High 8.8
    CVE-2023-36859

    PiiGAB M-Bus Code Injection

    PiiGAB M-Bus SoftwarePack 900S does not correctly sanitize user input, which could allow an attacker to inject arbitrary commands.

    PiiGAB M-Bus SoftwarePack
  • High 8.0
    CVE-2023-32652

    PiiGAB M-Bus Cross-site Scripting

    PiiGAB M-Bus does not validate identification strings before processing, which could make it vulnerable to cross-site scripting attacks.

    PiiGAB M-Bus SoftwarePack
  • High 7.5
    CVE-2023-31277

    PiiGAB M-Bus Unprotected Transport of Credentials

    PiiGAB M-Bus transmits credentials in plaintext format.

    PiiGAB M-Bus SoftwarePack
  • High 7.5
    CVE-2023-34433

    PiiGAB M-Bus Use of Password Hash With Insufficient Computational Effort

    PiiGAB M-Bus stores passwords using a weak hash algorithm.

    PiiGAB M-Bus SoftwarePack
  • High 7.5
    CVE-2023-34995

    PiiGAB M-Bus Weak Password Requirements

    There are no requirements for setting a complex password for PiiGAB M-Bus, which could contribute to a successful brute force attack if the password is inline with recommended password guidelines.

    PiiGAB M-Bus SoftwarePack
  • Medium 6.5
    CVE-2023-35765

    PiiGAB M-Bus Plaintext Storage of a Password

    PiiGAB M-Bus stores credentials in a plaintext file, which could allow a low-level user to gain admin credentials.

    PiiGAB M-Bus SoftwarePack
  • Medium 5.9
    CVE-2023-33868

    PiiGAB M-Bus Improper Restriction of Excessive Authentication Attempts

    The number of login attempts is not limited. This could allow an attacker to perform a brute force on HTTP basic authentication.

    PiiGAB M-Bus SoftwarePack

Revision history

  1. #1

    Initial Publication

References