CVE-2024-36059: Path Traversal

Q: What access does an attacker need to exploit this issue?

The vulnerability is remotely exploitable over the network with low attack complexity. It requires no privileges or user interaction.

Q: Which deployments are affected?

Kalkitech ASE61850 IEDSmart versions up to and including 2.3.5 are affected. Exposure depends on whether the IEC61850 File Transfer protocol is reachable by an attacker.

Q: What could an attacker do?

An attacker can use directory traversal through the IEC61850 File Transfer protocol to read and write arbitrary files. The reported impact includes high confidentiality and availability impact, with low integrity impact.

Published Jun 27, 2024

Updated

Directory Traversal vulnerability in Kalkitech ASE ASE61850 IEDSmart upto and including version 2.3.5 allows attackers to read/write arbitrary files via the IEC61850 File Transfer protocol.

Affected Software

1 affected component

Kalkitech ASE61850 IEDSmart<=2.3.5

Event History

Jun 27, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·10:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The vulnerability is remotely exploitable over the network with low attack complexity. It requires no privileges or user interaction.

Which deployments are affected?

Kalkitech ASE61850 IEDSmart versions up to and including 2.3.5 are affected. Exposure depends on whether the IEC61850 File Transfer protocol is reachable by an attacker.

What could an attacker do?

An attacker can use directory traversal through the IEC61850 File Transfer protocol to read and write arbitrary files. The reported impact includes high confidentiality and availability impact, with low integrity impact.

CVE-2024-36059: Path Traversal

Affected Software

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which deployments are affected?

What could an attacker do?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which deployments are affected?

What could an attacker do?