CVE-2023-2924
Published: 27 May 2023
Summary
CVE-2023-2924 is a medium-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Supcontech Simfield Firmware. Its CVSS base score is 4.7 (Medium).
Operationally, ranked in the top 10.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A vulnerability classified as CWE-434 has been identified in Supcon SimField versions up to 1.80.00.00. The issue resides in the /admin/reportupload.aspx file, where manipulation of the files[] parameter permits unrestricted file uploads. The flaw is remotely exploitable and was assigned VDB-230078 after public disclosure of a working exploit.
An authenticated attacker with high privileges can upload arbitrary files to the server, potentially achieving limited impacts on confidentiality, integrity, and availability as reflected in the CVSS 4.7 vector. The attack requires no user interaction and can be launched over the network.
No vendor patch or mitigation guidance has been issued; the vendor was contacted prior to disclosure but did not respond. Public references consist of exploit details hosted on GitHub and entries in the Vuldb database.
EPSS scores for the CVE rose from a low baseline to a recorded peak of 0.0719, indicating emerging exploitation interest after public disclosure. No confirmed reports of in-the-wild exploitation are available in the provided data.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-34370
Vulnerability details
A vulnerability, which was classified as critical, has been found in Supcon SimField up to 1.80.00.00. Affected by this issue is some unknown functionality of the file /admin/reportupload.aspx. The manipulation of the argument files[] leads to unrestricted upload. The attack…
more
may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-230078 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.
Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.
Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.
Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.