A vulnerability classified as critical was found in IntelliCom Netbiter Serial Ethernet Server Ss100 (the affected version is unknown). This vulnerability affects an unknown code. The manipulation of the argument file with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality. CVE summarizes:

Absolute path traversal vulnerability in cgi-bin/read.cgi in WebSCADA WS100 and WS200, Easy Connect EC150, Modbus RTU - TCP Gateway MB100, and Serial Ethernet Server SS100 on the IntelliCom NetBiter NB100 and NB200 platforms allows remote authenticated administrators to read arbitrary files via a full pathname in the file parameter, a different vulnerability than CVE-2009-4463.

The weakness was shared 02/14/2011 (Website). The advisory is available at us-cert.gov. This vulnerability was named CVE-2010-4731 since 02/14/2011. The exploitation appears to be easy. The attack can be initiated remotely. A single authentication is needed for exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1006 by the MITRE ATT&CK project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-56496, VDB-56495 and VDB-56493 are related to this item.

Productinfo

Vendor

• IntelliCom

Name

• Netbiter Serial Ethernet Server Ss100

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion