title: Commend WS203VICM Improper Access Control
description:
A remote attacker may be able to bypass access control of Commend WS203VICM by creating a malicious request.
problem types: CWE-284
affected:
{
defaultStatus: unaffected
product: WS203VICM
vendor: Commend
versions:
lessThanOrEqual: 1.7, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.4
baseSeverity: CRITICAL
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Although this is an end-of-life product, Commend has created new firmware  version WS-CM 2.0 https://clibrary-online.commend.com/   to
address the first two issues. The new firmware can be loaded via the
program "IP Station Config". To install the firmware, follow the
instructions below:
*  Log in to the Commend web-portal.
*  Download and extract the "Terminals Software Package".
*  In "IP Station Config", select the stations to be updated in the table.
*  Go to: Menu Station > Firmware Download
*  Select the file "WS-CM 2.0.geh" from the folder "WS-CM" and click on the button Open.
For additional information, please visit  CSA-2024-42 on Commend's cybersecurity website. https://clibrary-online.commend.com/en/cyber-security/security-advisories.html