ICSA-24-254-01

Viessmann Climate Solutions SE Vitogate 300

view advisory published 2024-09-10

Successful exploitation of these vulnerabilities could allow an attacker to achieve remote code execution.

describes (3)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-5702US	medium6.5	19.4% (97th)	Exploit	2023-10-23
A vulnerability was found in Viessmann Vitogate 300 up to 2.1.3.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /cgi-bin/. The man…
CVE-2023-45852US	critical9.8	15.2% (97th)	—	2023-10-14
In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands via shell metacharacters in the ipaddr par…
CVE-2023-5222US	critical9.8OT high	80.4% (100th)	Exploit	2023-09-27
A vulnerability classified as critical was found in Viessmann Vitogate 300 up to 2.1.3.0. This vulnerability affects the function isValidUser of the file /cgi-bin/vitogate.cgi of t…

External citations — patches, advisories, analysis.

MitigationViessmann Vitogate 300
Viessmann Climate Solutions SE recommends customers update to version 3.0.0.0 to fix these vulnerabilities. The software is available to download at their (website)
https://connectivity.viessmann.com/de/mp-fp/vitogate/vitogate-300-bn-mb.html
MitigationViessmann Vitogate 300
Viessmann Climate Solutions SE recommends customers update to version 3.0.0.0 to fix these vulnerabilities. The software is available to download at their (website)
https://connectivity.viessmann.com/de/mp-fp/vitogate/vitogate-300-bn-mb.html
MitigationViessmann Vitogate 300
Viessmann Climate Solutions SE recommends customers update to version 3.0.0.0 to fix these vulnerabilities. The software is available to download at their (website)
https://connectivity.viessmann.com/de/mp-fp/vitogate/vitogate-300-bn-mb.html

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.