Multilaser RE057/RE170 2.1/2.2 Backup File /param.file.tgz information disclosure
A vulnerability, which was classified as critical, was found in Multilaser RE057 and RE170 2.1/2.2. This affects an unknown part of the file /param.file.tgz of the component Backup File Handler. The manipulation leads to information disclosure. The CWE definition for the vulnerability is CWE-200. The weakness was presented 02/02/2023. This vulnerability is uniquely identified as CVE-2023-0658. It is possible to initiate the attack remotely. Technical details are available. Furthermore, there is an exploit available. The price for an exploit might be around USD $0-$5k at the moment. MITRE ATT&CK project uses the attack technique T1592 for this issue. It is declared as proof-of-concept. We expect the 0-day to have been worth approximately $0-$5k. A possible mitigation has been published before and not just after the disclosure of the vulnerability.