CVE-2023-24838CWE-200

HGiga PowerStation - Information Leakage

Critical · published March 27, 2023

CVSS v3.1
9.8
EPSS
1%
Percentile
65.4
In the wild
Unconfirmed
What it is

🚨 An unauthenticated remote attacker can snag the admin credentials with just a few keystrokes! 🔥 Think of it like a vendor's sale flyer that accidentally lists your store’s security codes; all it takes is one curious shopper to unlock the vault! If exploited, an attacker can gain full access to the PowerStation, potentially executing remote code. This means they could manipulate the system, disrupt operations, or steal sensitive information—absolutely devastating! 😱

Put simply

Think of it like a vendor's sale flyer that accidentally lists your store’s security codes; all it takes is one curious shopper to unlock the vault! This information leakage flaw in HGiga PowerStation allows unauthorized remote attackers to access sensitive administrator credentials, potentially leading to remote code execution via Secure Shell or the PowerStation interface.

What to do

If exploited, an attacker can gain full access to the PowerStation, potentially executing remote code. This means they could manipulate the system, disrupt operations, or steal sensitive information—absolutely devastating! 😱 To mitigate this risk, ensure to upgrade to the patched version of the software as soon as it's available. Additionally, implement strict access controls and regularly audit user permissions to prevent unauthorized access. 🔒 You've got this! Follow these steps, and you’ll keep that vault locked tight! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01100 · 65.4th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2023-03-27T00:00Z
EPSS history
Timeline
  • 27 MAR 00:00Z
    HGiga PowerStation - Information Leakage
    cvelistv5