Auth bypass in Franklinfueling Ts-550 Evo
CVE-2017-6565
On Franklin Fueling Systems TS-550 evo 2.3.0.7332 devices, the roleDiag user, which can be obtained by exploiting CVE-2013-7247, has the ability to upload files to the server hosting the web service. As no sanitization checks are in place, an attacker can upload a malicious payload.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.010 (62.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 62nd percentile — 62.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: 0.000
Affected products
- Franklinfueling Ts-550 Evo
- Franklinfueling Ts-550 Evo Firmware — versions 2.3.0.7332
Weakness classification (CWE)
References
- www.u235.io/single-post/2017/05/01/Penetrating-Fuel-Management-Systems (Technical Description, URL Repurposed, Third Party Advisory)
- gist.github.com/Stick-U235/b187931f828e92866d09b9bdeb956ca2 (Third Party Advisory)
Frequently asked questions
- What is CVE-2017-6565?
- CVE-2017-6565 is a high-severity vulnerability in Franklinfueling Ts-550 Evo, classified under Missing Authorization. CVSS score: 8.8/10. Published 2017-05-01.
- How severe is CVE-2017-6565?
- High severity. CVSS v3 base score is 8.8 out of 10.