Description
A low privileged remote attacker can upload arbitrary data masked as a png file to the affected device using the webserver API because only the file extension is verified.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Sauter modulo 6 devices modu680-AS
Default version status: unaffected
0.0.0 to < Firmware v3.2.0affected
Sauter modulo 6 devices modu660-AS
Default version status: unaffected
0.0.0 to < Firmware v3.2.0affected
Sauter modulo 6 devices modu612-LC
Default version status: unaffected
0.0.0 to < Firmware v3.2.0affected
Sauter EY-modulo 5 modu 5 modu524
Default version status: unaffected
0.0 to < Firmware v6.0affected
Sauter EY-modulo 5 modu 5 modu525
Default version status: unaffected
0.0 to < Firmware v6.0affected
Sauter EY-modulo 5 ecos 5 ecos504/505
Default version status: unaffected
0.0 to < Firmware v6.0affected