• Menu
  • Skip to main content
  • Skip to primary sidebar

The Cyber Security News

Latest Cyber Security News

Header Right

  • Latest News
  • Vulnerabilities
  • Cloud Services
multiple flaws found in scrutisweb software exposes atms to remote

Multiple Flaws Found in ScrutisWeb Software Exposes ATMs to Remote Hacking

You are here: Home / General Cyber Security News / Multiple Flaws Found in ScrutisWeb Software Exposes ATMs to Remote Hacking
August 15, 2023

Four security vulnerabilities in the ScrutisWeb ATM fleet monitoring software made by Iagona could be exploited to remotely break into ATMs, upload arbitrary files, and even reboot the terminals.

The shortcomings were discovered by the Synack Red Team (SRT) following a client engagement. The issues have been addressed in ScrutisWeb version 2.1.38.

“Successful exploitation of these vulnerabilities could allow an attacker to upload and execute arbitrary files,” the U.S. Cybersecurity and Infrastructure Security Agency (CISA) said in an advisory published last month.

✔ Approved From Our Partners
AOMEI Backupper Lifetime

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code


ScrutisWeb is a web browser-based solution for monitoring banking and retail ATM fleets, including gleaning information system status, detecting low paper alerts, shutting down or restarting a terminal, and remotely modifying data.

Cybersecurity

Details of the four flaws are as follows –

  • CVE-2023-33871 (CVSS score: 7.5) – A directory traversal vulnerability that could allow an unauthenticated user to directly access any file outside the server’s webroot.
  • CVE-2023-35189 (CVSS score: 10.0) – A remote code execution vulnerability that could allow an unauthenticated user to upload a malicious payload and execute it.
  • CVE-2023-35763 (CVSS score: 5.5) – A cryptographic vulnerability that could allow an unauthenticated user to decrypt encrypted passwords into plaintext.
  • CVE-2023-38257 (CVSS score: 7.5) – An insecure direct object reference vulnerability that could allow an unauthenticated user to view profile information, including user login names and encrypted passwords.

The most severe of the flaws is CVE-2023-35189, as it enables an unauthenticated user to upload any file and then view it again from a web browser, resulting in command injection.

Cybersecurity

In a hypothetical attack scenario, an adversary could weaponize CVE-2023-38257 and CVE-2023-35763 to log into the ScrutisWeb management console as an administrator.

“From here, a malicious actor would be able to monitor activities on individual ATMs within the fleet. The console also allows for dropping ATMs into management mode, uploading files to them, rebooting them, and powering them completely off,” Synack said.

Furthermore, CVE-2023-35189 could be used to delete log files on ScrutisWeb to cover up the tracks.

“Additional exploitation from this foothold in the client’s infrastructure could occur, making this an internet-facing pivot point for a malicious actor,” the researchers said.

Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.


Some parts of this article are sourced from:
thehackernews.com

Previous Post: «monti ransomware returns with new linux variant and enhanced evasion Monti Ransomware Returns with New Linux Variant and Enhanced Evasion Tactics
Next Post: Cybercriminals Abusing Cloudflare R2 for Hosting Phishing Pages, Experts Warn cybercriminals abusing cloudflare r2 for hosting phishing pages, experts warn»

Reader Interactions

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Primary Sidebar

Report This Article

Recent Posts

  • Over 269,000 Websites Infected with JSFireTruck JavaScript Malware in One Month
  • Ransomware Gangs Exploit Unpatched SimpleHelp Flaws to Target Victims with Double Extortion
  • CTEM is the New SOC: Shifting from Monitoring Alerts to Measuring Risk
  • Apple Zero-Click Flaw in Messages Exploited to Spy on Journalists Using Paragon Spyware
  • WordPress Sites Turned Weapon: How VexTrio and Affiliates Run a Global Scam Network
  • New TokenBreak Attack Bypasses AI Moderation with Single-Character Text Changes
  • AI Agents Run on Secret Accounts — Learn How to Secure Them in This Webinar
  • Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data Without User Interaction
  • Non-Human Identities: How to Address the Expanding Security Risk
  • ConnectWise to Rotate ScreenConnect Code Signing Certificates Due to Security Risks

Copyright © TheCyberSecurity.News, All Rights Reserved.