CVE-2023-23575

Improper access control vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker to bypass access restriction and access Network Maintenance page, which may result in obtaining the network information of the product. The affected products and versions are as follows: M2M Gateway with the firmware Ver.3.7.10 and earlier (CPS-MG341-ADSC1-111, CPS-MG341-ADSC1-931, CPS-MG341G-ADSC1-111, CPS-MG341G-ADSC1-930, and CPS-MG341G5-ADSC1-931), M2M Controller Integrated Type with firmware Ver.3.7.6 and earlier versions (CPS-MC341-ADSC1-111, CPS-MC341-ADSC1-931, CPS-MC341-ADSC2-111, CPS-MC341G-ADSC1-110, CPS-MC341Q-ADSC1-111, CPS-MC341-DS1-111, CPS-MC341-DS11-111, CPS-MC341-DS2-911, and CPS-MC341-A1-111), and M2M Controller Configurable Type with firmware Ver.3.8.8 and earlier versions (CPS-MCS341-DS1-111, CPS-MCS341-DS1-131, CPS-MCS341G-DS1-130, CPS-MCS341G5-DS1-130, and CPS-MCS341Q-DS1-131).

• CWE-284

• https://jvn.jp/en/vu/JVNVU96198617/Third Party Advisory
• https://www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_cps_230317_en.pdfMitigation, Vendor Advisory
• https://www.contec.com/download/donwload-list/?itemid=a054b3eb-da97-40d0-9598-d7f5ff4239ec#firmwareProduct
• https://www.contec.com/download/donwload-list/?itemid=a1b33f0d-d32b-4549-9741-613cd37d5528#firmwareProduct
• https://www.contec.com/download/donwload-list/?itemid=f832c526-dcf6-4976-85aa-f536c15a8120#firmwareProduct
• https://jvn.jp/en/vu/JVNVU96198617/Third Party Advisory
• https://www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_cps_230317_en.pdfMitigation, Vendor Advisory
• https://www.contec.com/download/donwload-list/?itemid=a054b3eb-da97-40d0-9598-d7f5ff4239ec#firmwareProduct
• https://www.contec.com/download/donwload-list/?itemid=a1b33f0d-d32b-4549-9741-613cd37d5528#firmwareProduct
• https://www.contec.com/download/donwload-list/?itemid=f832c526-dcf6-4976-85aa-f536c15a8120#firmwareProduct

Published

Apr 11, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-23569Stack-based buffer overflow for some Intel(R) Trace Analyzer…7.8
• CVE-2023-23570 Client-Side enforcement of Server-Side security for the Com…8.1
• CVE-2023-23571An access violation vulnerability exists in the eventcore fu…7.5
• CVE-2023-23572Cross-site scripting vulnerability in SEIKO EPSON printers/n…4.8
• CVE-2023-23573Improper access control in the Intel(R) Unite(R) android app…4.4
• CVE-2023-23574A blind SQL Injection vulnerability in Nozomi Networks Guard…8.8
• CVE-2023-23576 Incorrect behavior order in the Command Centre Server could…4.3
• CVE-2023-23577Uncontrolled search path element for some ITE Tech consumer …7.3
• CVE-2023-23578Improper access control vulnerability in SkyBridge MB-A200 f…7.5
• CVE-2023-23579 Datakit CrossCadWare_x64.dll contains an out-of-bou…7.8
• CVE-2023-2358 Hitachi Vantara Pentaho Business Analytics Server prior to …4.9
• CVE-2023-23580Stack-based buffer overflow for some Intel(R) Trace Analyzer…7.8