Skip to content
OpenAdvisories
Medium ICSA-23-353-03 4 CVEs

EFACEC UC 500E

Published Dec 19, 2023 · Updated Dec 19, 2023

Vendor: EFACEC Product: UC 500E

Summary

Successful exploitation of these vulnerabilities could allow an attacker to retrieve sensitive information, gain unauthorized access to the product, or redirect users to malicious websites.

Vulnerabilities 4

  • Medium 6.3
    CVE-2023-50703

    Cleartext Transmission of Sensitive Information in EFACEC UC 500E

    An attacker with network access could perform a man-in-the-middle (MitM) attack and capture sensitive information to gain unauthorized access to the application.

    EFACEC UC 500E
  • Medium 5.3
    CVE-2023-50705

    Exposure of Sensitive Information to an Unauthorized Actor in EFACEC UC 500E

    An attacker could create malicious requests to obtain sensitive information about the web server.

    EFACEC UC 500E
  • Medium 4.3
    CVE-2023-50704

    URL Redirection to Untrusted Site ('Open Redirect') in EFACEC UC 500E

    An attacker could construct a URL within the application that causes a redirection to an arbitrary external domain and could be leveraged to facilitate phishing attacks against application users.

    EFACEC UC 500E
  • Medium 4.1
    CVE-2023-50706

    Improper Access Control in EFACEC UC 500E

    A user without administrator permissions with access to the UC500 windows system could perform a memory dump of the running processes and extract clear credentials or valid session tokens.

    EFACEC UC 500E

Revision history

  1. #1

    Initial Publication

References