What’s Vulnerable › Vulnerabilities

CVE-2023-0956: TEL-STER TelWin SCADA WebInterface Path Traversal

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-08-03 · updated 2026-06-17
• Weakness: CWE-22

Description

External input could be used on TEL-STER TelWin SCADA WebInterface to construct paths to files and directories without properly neutralizing special elements within the pathname, which could allow an unauthenticated attacker to read files on the system.

Affected products

• TEL-STER TelWin SCADA WebInterface: from 3.2 before 6.2; from 7.0 before 7.2; 8.0, 9.0 — fixed in 6.2, 7.2

How to fix

Upgrade to a fixed version: TEL-STER TelWin SCADA WebInterface 6.2, 7.2. Check the vendor advisory for mitigations.

References

• https://cert.pl/posts/2023/07/CVE-2023-0956/
• https://www.cisa.gov/news-events/ics-advisories/icsa-23-215-03
• https://www.tel-ster.pl/index.php/telwin-scada/nowosci/372-telwin-scada-podatnosc-cve-2023-0956
• https://cert.pl/posts/2023/07/CVE-2023-0956/
• https://www.cisa.gov/news-events/ics-advisories/icsa-23-215-03
• https://www.tel-ster.pl/index.php/telwin-scada/nowosci/372-telwin-scada-podatnosc-cve-2023-0956

Get alerted when CVE-2023-0956 or the next vulnerability affects your stack