{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-23575", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "assignerShortName": "jpcert", "dateUpdated": "2023-04-11T00:00:00", "dateReserved": "2023-03-14T00:00:00", "datePublished": "2023-04-11T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2023-04-11T00:00:00"}, "descriptions": [{"lang": "en", "value": "Improper access control vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker to bypass access restriction and access Network Maintenance page, which may result in obtaining the network information of the product. The affected products and versions are as follows: M2M Gateway with the firmware Ver.3.7.10 and earlier (CPS-MG341-ADSC1-111, CPS-MG341-ADSC1-931, CPS-MG341G-ADSC1-111, CPS-MG341G-ADSC1-930, and CPS-MG341G5-ADSC1-931), M2M Controller Integrated Type with firmware Ver.3.7.6 and earlier versions (CPS-MC341-ADSC1-111, CPS-MC341-ADSC1-931, CPS-MC341-ADSC2-111, CPS-MC341G-ADSC1-110, CPS-MC341Q-ADSC1-111, CPS-MC341-DS1-111, CPS-MC341-DS11-111, CPS-MC341-DS2-911, and CPS-MC341-A1-111), and M2M Controller Configurable Type with firmware Ver.3.8.8 and earlier versions (CPS-MCS341-DS1-111, CPS-MCS341-DS1-131, CPS-MCS341G-DS1-130, CPS-MCS341G5-DS1-130, and CPS-MCS341Q-DS1-131)."}], "affected": [{"vendor": "Contec CO.,LTD.", "product": "CONPROSYS IoT Gateway products", "versions": [{"version": "M2M Gateway with the firmware Ver.3.7.10 and earlier (CPS-MG341-ADSC1-111, CPS-MG341-ADSC1-931, CPS-MG341G-ADSC1-111, CPS-MG341G-ADSC1-930, and CPS-MG341G5-ADSC1-931), M2M Controller Integrated Type with firmware Ver.3.7.6 and earlier versions (CPS-MC341-ADSC1-111, CPS-MC341-ADSC1-931, CPS-MC341-ADSC2-111, CPS-MC341G-ADSC1-110, CPS-MC341Q-ADSC1-111, CPS-MC341-DS1-111, CPS-MC341-DS11-111, CPS-MC341-DS2-911, and CPS-MC341-A1-111), and M2M Controller Configurable Type with firmware Ver.3.8.8 and earlier versions (CPS-MCS341-DS1-111, CPS-MCS341-DS1-131, CPS-MCS341G-DS1-130, CPS-MCS341G5-DS1-130, and CPS-MCS341Q-DS1-131)", "status": "affected"}]}], "references": [{"url": "https://www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_cps_230317_en.pdf"}, {"url": "https://www.contec.com/download/donwload-list/?itemid=f832c526-dcf6-4976-85aa-f536c15a8120#firmware"}, {"url": "https://www.contec.com/download/donwload-list/?itemid=a054b3eb-da97-40d0-9598-d7f5ff4239ec#firmware"}, {"url": "https://www.contec.com/download/donwload-list/?itemid=a1b33f0d-d32b-4549-9741-613cd37d5528#firmware"}, {"url": "https://jvn.jp/en/vu/JVNVU96198617/"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "Improper access control"}]}]}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:contec:cps-mg341-adsc1-111_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "946A1696-7212-4787-A93C-7B6EDE53D996", "versionEndIncluding": "3.7.10", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:contec:cps-mg341-adsc1-111:-:*:*:*:*:*:*:*", "matchCriteriaId": "D9638515-553F-477E-9673-0CABD9151E35", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:contec:cps-mg341-adsc1-931_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "56B10D03-57E7-455E-8E8E-AD3582D24D6F", "versionEndIncluding": "3.7.10", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:contec:cps-mg341-adsc1-931:-:*:*:*:*:*:*:*", "matchCriteriaId": "72421FDB-FCDB-428E-82A0-3C7ED662E77E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:contec:cps-mg341g-adsc1-111_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "D5849A88-069E-433D-BED6-2C74B3F6E30B", "versionEndIncluding": "3.7.10", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:contec:cps-mg341g-adsc1-111:-:*:*:*:*:*:*:*", "matchCriteriaId": "B2E2F1D4-BA1E-4069-87DC-9DD0216AB7FB", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:contec:cps-mg341g-adsc1-930_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "604E57A1-850D-4FF0-8D4E-67717FA2EFF1", "versionEndIncluding": "3.7.10", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:contec:cps-mg341g-adsc1-930:-:*:*:*:*:*:*:*", "matchCriteriaId": "8027E77D-4F44-482D-9748-815FECCC94E6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:contec:cps-mg341g5-adsc1-931_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "17D8495F-D070-43BB-8CE1-EC3692B40F2C", "versionEndIncluding": "3.7.10", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:contec:cps-mg341g5-adsc1-931:-:*:*:*:*:*:*:*", "matchCriteriaId": "27224ED7-6205-4E2D-B452-6329C6B58EAF", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:contec:cps-mc341-adsc1-111_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "23CD1E0D-AE78-4498-8817-5C1FCDF4B921", "versionEndIncluding": "3.7.6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:contec:cps-mc341-adsc1-111:-:*:*:*:*:*:*:*", "matchCriteriaId": "7A7EE4F3-F8F1-4BC5-B5FA-69D92D389793", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:contec:cps-mc341-adsc1-931_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "65F5FA0E-C040-4CA6-A53F-DC9EDAA4EFE9", "versionEndIncluding": "3.7.6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:contec:cps-mc341-adsc1-931:-:*:*:*:*:*:*:*", "matchCriteriaId": "98E492A7-E7AC-458B-9952-408D915C9AC2", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:contec:cps-mc341-adsc2-111_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "80DAF840-FFCC-4E4F-A964-A0D3D9761E2E", "versionEndIncluding": "3.7.6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:contec:cps-mc341-adsc2-111:-:*:*:*:*:*:*:*", "matchCriteriaId": "A79518B9-A98D-4D71-9F96-E8F9FF441BB6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:contec:cps-mc341g-adsc1-110_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "5A00EE55-8CFC-434A-B187-442F3184BCD3", "versionEndIncluding": "3.7.6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:contec:cps-mc341g-adsc1-110:-:*:*:*:*:*:*:*", "matchCriteriaId": "289A036E-C360-4192-BD4B-FD046B1D48D0", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:contec:cps-mc341q-adsc1-111_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "94F943B3-1397-48D7-BE7C-6C4A773F821E", "versionEndIncluding": "3.7.6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:contec:cps-mc341q-adsc1-111:-:*:*:*:*:*:*:*", "matchCriteriaId": "3CD6F197-ED5A-4414-9CAD-666732EB1E63", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:contec:cps-mc341-ds1-111_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "DE3C651C-68A3-4776-826F-3CCCF8DC2C24", "versionEndIncluding": "3.7.6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:contec:cps-mc341-ds1-111:-:*:*:*:*:*:*:*", "matchCriteriaId": "067D054D-D81A-400F-8883-AD290F4F346E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:contec:cps-mc341-ds11-111_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "14143147-D19C-4C83-A49D-D47E29B990DE", "versionEndIncluding": "3.7.6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:contec:cps-mc341-ds11-111:-:*:*:*:*:*:*:*", "matchCriteriaId": "019C8FDA-B856-4D9F-BF59-B25A8EAE4489", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:contec:cps-mc341-ds2-911_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "F0EF7B61-73C1-4467-AD42-A38DBF420510", "versionEndIncluding": "3.7.6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:contec:cps-mc341-ds2-911:-:*:*:*:*:*:*:*", "matchCriteriaId": "A04D8729-A3A8-4FBA-A3FA-0D1C9E0CC607", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:contec:cps-mc341-a1-111_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "0EB5F6C9-C2D4-4735-A3E8-9C2C59812E5F", "versionEndIncluding": "3.7.6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:contec:cps-mc341-a1-111:-:*:*:*:*:*:*:*", "matchCriteriaId": "29496995-56D5-485B-9D18-6519D8486272", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:contec:cps-mcs341-ds1-111_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "F74B9B92-0B7D-441C-93BF-7F152CF02FBA", "versionEndIncluding": "3.8.8", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:contec:cps-mcs341-ds1-111:-:*:*:*:*:*:*:*", "matchCriteriaId": "791D09FA-1CBA-4334-B62D-DDE8CC4FE629", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:contec:cps-mcs341-ds1-131_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "4DE8075E-9645-4C32-984C-1ECA947645D9", "versionEndIncluding": "3.8.8", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:contec:cps-mcs341-ds1-131:-:*:*:*:*:*:*:*", "matchCriteriaId": "2A77D134-C344-4900-933E-DEC74F8DB29D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:contec:cps-mcs341g-ds1-130_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "6ECA4990-8F3D-41C7-AC96-6EA10AB58AE4", "versionEndIncluding": "3.8.8", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:contec:cps-mcs341g-ds1-130:-:*:*:*:*:*:*:*", "matchCriteriaId": "D4CEA79F-F7DD-4E29-82DC-E828C27A80B8", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:contec:cps-mcs341g5-ds1-130_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "9AA64568-FE3F-4C4C-8DFF-C77B226004FA", "versionEndIncluding": "3.8.8", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:contec:cps-mcs341g5-ds1-130:-:*:*:*:*:*:*:*", "matchCriteriaId": "7B5B4009-93EB-462B-A9A3-A42506DDA853", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:contec:cps-mcs341q-ds1-131_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "66D99898-0EB9-4728-8C97-476AE6BF1746", "versionEndIncluding": "3.8.8", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:contec:cps-mcs341q-ds1-131:-:*:*:*:*:*:*:*", "matchCriteriaId": "8A570103-F5D1-48D3-A7D1-9F8ED71B44DD", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Improper access control vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker to bypass access restriction and access Network Maintenance page, which may result in obtaining the network information of the product. The affected products and versions are as follows: M2M Gateway with the firmware Ver.3.7.10 and earlier (CPS-MG341-ADSC1-111, CPS-MG341-ADSC1-931, CPS-MG341G-ADSC1-111, CPS-MG341G-ADSC1-930, and CPS-MG341G5-ADSC1-931), M2M Controller Integrated Type with firmware Ver.3.7.6 and earlier versions (CPS-MC341-ADSC1-111, CPS-MC341-ADSC1-931, CPS-MC341-ADSC2-111, CPS-MC341G-ADSC1-110, CPS-MC341Q-ADSC1-111, CPS-MC341-DS1-111, CPS-MC341-DS11-111, CPS-MC341-DS2-911, and CPS-MC341-A1-111), and M2M Controller Configurable Type with firmware Ver.3.8.8 and earlier versions (CPS-MCS341-DS1-111, CPS-MCS341-DS1-131, CPS-MCS341G-DS1-130, CPS-MCS341G5-DS1-130, and CPS-MCS341Q-DS1-131)."}], "id": "CVE-2023-23575", "lastModified": "2023-04-18T19:36:02.697", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-04-11T09:15:07.753", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/vu/JVNVU96198617/"}, {"source": "vultures@jpcert.or.jp", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_cps_230317_en.pdf"}, {"source": "vultures@jpcert.or.jp", "tags": ["Product"], "url": "https://www.contec.com/download/donwload-list/?itemid=a054b3eb-da97-40d0-9598-d7f5ff4239ec#firmware"}, {"source": "vultures@jpcert.or.jp", "tags": ["Product"], "url": "https://www.contec.com/download/donwload-list/?itemid=a1b33f0d-d32b-4549-9741-613cd37d5528#firmware"}, {"source": "vultures@jpcert.or.jp", "tags": ["Product"], "url": "https://www.contec.com/download/donwload-list/?itemid=f832c526-dcf6-4976-85aa-f536c15a8120#firmware"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}