title: TEL-STER TelWin SCADA WebInterface Path Traversal
description:
External input could be used on TEL-STER TelWin SCADA WebInterface to construct paths to files and directories without properly neutralizing special elements within the pathname, which could allow an unauthenticated attacker to read files on the system.
problem types: cwe-35 Path Traversal
affected:
{
defaultStatus: unaffected
product: TelWin SCADA WebInterface
vendor: TEL-STER
versions:
lessThanOrEqual: 6.1, status: affected, version: 3.2, versionType: custom
lessThanOrEqual: 7.1, status: affected, version: 7.0, versionType: custom
lessThanOrEqual: 9.0, status: affected, version: 8.0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions:
TEL-STER recommends that users  update WebInterface module https://www.tel-ster.pl/index.php/en/telwin-scada-eng/news-telwin-eng  to one of the following versions: 6.2, 7.2, 8.1, 9.1, or 10.0. Please note that the WebInterface is part of the TelWin SCADA software and is usually updated with the software. TEL-STER only currently supports and updates TelWin SCADA 7.8 (WebInteraface 6.x) upwards TEL-STER does not have any updates planned for versions using older vulnerable WebInterface (lower than 6.0), and users are recommended to update TelWin SCADA to one of the supported versions. For more information, please contact TEL-STER.
More information about this issue and the associated mitigation can be found at  TEL-STER advisory https://www.tel-ster.pl/index.php/telwin-scada/nowosci/372-telwin-scada-podatnosc-cve-2023-0956  or  CERT.PL advisory https://cert.pl/posts/2023/07/CVE-2023-0956/ .