CVE-2023-34394: Keysight N6845A Relative Path Traversal

Q: What is the vulnerability ID for this vulnerability?

The vulnerability ID is CVE-2023-34394.

Q: What is the affected software?

The affected software is Keysight Geolocation Server v2.4.2 and prior.

Q: What is the severity rating of CVE-2023-34394?

The severity rating of CVE-2023-34394 is high with a score of 7.8.

Q: What is the CWE ID for this vulnerability?

The CWE ID for this vulnerability is 434 and 23.

Q: How can an attacker exploit CVE-2023-34394?

An attacker can exploit CVE-2023-34394 by uploading a specially crafted malicious file or deleting any file or directory with SYSTEM privileges.

Published Jul 19, 2023

Updated

In Keysight Geolocation Server v2.4.2 and prior, an attacker could upload a specially crafted malicious file or delete any file or directory with SYSTEM privileges due to an improper path validation, which could result in local privilege escalation or a denial-of-service condition.

Affected Software

2 affected components

Keysight Technologies N6854A Geolocation Server versions 2.4.2 and prior

keysight Geolocation Server<=2.4.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Keysight N6854A Geolocation server to a version that resolves this vulnerability.
Fixed in 2.4.3

Event History

Jul 19, 2023

CVE Published

via MITRE·09:55 PM

Data Sourced

via MITRE·09:55 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:15 PM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

ICSA-23-199-02

Frequently Asked Questions

What is the vulnerability ID for this vulnerability?

The vulnerability ID is CVE-2023-34394.

What is the affected software?

The affected software is Keysight Geolocation Server v2.4.2 and prior.

What is the severity rating of CVE-2023-34394?