CVE-2023-0956
📋 TL;DR
CVE-2023-0956 is a path traversal vulnerability in TEL-STER TelWin SCADA WebInterface that allows unauthenticated attackers to read arbitrary files on the system by manipulating file paths. This affects organizations using TelWin SCADA systems with the vulnerable web interface exposed.
💻 Affected Systems
- TEL-STER TelWin SCADA
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through reading sensitive configuration files, credentials, or system files leading to further attacks on SCADA/ICS infrastructure.
Likely Case
Unauthenticated attackers reading sensitive files containing configuration data, credentials, or system information that could enable further attacks.
If Mitigated
Limited impact with proper network segmentation and access controls preventing external access to the web interface.
🎯 Exploit Status
The vulnerability is straightforward to exploit with publicly available information about the path traversal technique.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to latest TelWin SCADA version as specified by vendor
Vendor Advisory: https://www.tel-ster.pl/index.php/telwin-scada/nowosci/372-telwin-scada-podatnosc-cve-2023-0956
Restart Required: Yes
Instructions:
1. Contact TEL-STER for the security update. 2. Apply the patch following vendor instructions. 3. Restart the SCADA system and WebInterface service. 4. Verify the fix is applied.
🔧 Temporary Workarounds
Network Segmentation
allIsolate SCADA systems from untrusted networks and restrict access to the WebInterface.
Access Control
allImplement strict firewall rules to limit access to the WebInterface port (typically HTTP/HTTPS).
🧯 If You Can't Patch
- Implement strict network segmentation to isolate SCADA systems from untrusted networks
- Deploy web application firewall (WAF) with path traversal protection rules
🔍 How to Verify
Check if Vulnerable:
Test if the WebInterface accepts path traversal sequences (e.g., ../) in file requests. Monitor for unauthorized file access attempts.Check Version:
Check TelWin SCADA version through the WebInterface or system configurationVerify Fix Applied:
Verify the patch is applied by checking version and testing that path traversal attempts are properly blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in WebInterface logs
- Multiple failed attempts with path traversal sequences
Network Indicators:
- HTTP requests containing ../ sequences to the SCADA WebInterface
SIEM Query:
web.url:*../* AND destination.port:(80 OR 443) AND destination.ip:SCADA_SYSTEM_IP🔗 References
- https://cert.pl/posts/2023/07/CVE-2023-0956/
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-215-03
- https://www.tel-ster.pl/index.php/telwin-scada/nowosci/372-telwin-scada-podatnosc-cve-2023-0956
- https://cert.pl/posts/2023/07/CVE-2023-0956/
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-215-03
- https://www.tel-ster.pl/index.php/telwin-scada/nowosci/372-telwin-scada-podatnosc-cve-2023-0956
