CVE-2023-45596

Vulnerability

A CWE-425 "Direct Request ('Forced Browsing')" vulnerability exists in the file_configuration functionality of the AiLux imx6 bundle. This issue affects all versions below imx6_1.0.7-2. The vulnerability allows an attacker to directly request configuration files without proper access controls, bypassing intended restrictions [1].

Exploitation

An unauthenticated remote attacker can exploit this vulnerability by sending a crafted HTTP request to the file_configuration endpoint. No authentication, user interaction, or special network position is required; the attacker only needs network access to the device [1].

Impact

Successful exploitation results in the disclosure of confidential configuration files. The impact is limited to confidentiality (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), with no impact on integrity or availability. The attacker gains access to sensitive device configuration data [1].

Mitigation

Update the AiLux imx6 bundle to version imx6_1.0.7-2 or later. No workarounds are documented. The fix is available and addresses the forced browsing vulnerability [1].