Cyber Resilience

CVE-2023-2924

MediumPublic PoC

Published: 27 May 2023

Published
27 May 2023
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0498 89.9th percentile
Risk Priority 12 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-2924 is a medium-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Supcontech Simfield Firmware. Its CVSS base score is 4.7 (Medium).

Operationally, ranked in the top 10.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

A vulnerability classified as CWE-434 has been identified in Supcon SimField versions up to 1.80.00.00. The issue resides in the /admin/reportupload.aspx file, where manipulation of the files[] parameter permits unrestricted file uploads. The flaw is remotely exploitable and was assigned VDB-230078 after public disclosure of a working exploit.

An authenticated attacker with high privileges can upload arbitrary files to the server, potentially achieving limited impacts on confidentiality, integrity, and availability as reflected in the CVSS 4.7 vector. The attack requires no user interaction and can be launched over the network.

No vendor patch or mitigation guidance has been issued; the vendor was contacted prior to disclosure but did not respond. Public references consist of exploit details hosted on GitHub and entries in the Vuldb database.

EPSS scores for the CVE rose from a low baseline to a recorded peak of 0.0719, indicating emerging exploitation interest after public disclosure. No confirmed reports of in-the-wild exploitation are available in the provided data.

EU & UK References

Vulnerability details

A vulnerability, which was classified as critical, has been found in Supcon SimField up to 1.80.00.00. Affected by this issue is some unknown functionality of the file /admin/reportupload.aspx. The manipulation of the argument files[] leads to unrestricted upload. The attack…

more

may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-230078 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

supcontech
simfield firmware
≤ 1.80.00.00

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-434

Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.

addresses: CWE-434

Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.

addresses: CWE-434

Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.

addresses: CWE-434

Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.

References