Description Preview
A critical information disclosure vulnerability has been identified in Sme.UP ERP TOKYO V6R1M220406. The vulnerability exists in the /debug endpoint which inappropriately exposes sensitive information. Specifically, attackers can access cleartext credentials that are used for authentication to the AS400 system. This vulnerability is classified as CWE-312 (Cleartext Storage of Sensitive Information) and could potentially lead to unauthorized access to the AS400 system if exploited.
Overview
The vulnerability in Sme.UP ERP TOKYO V6R1M220406 allows unauthorized users to access sensitive authentication credentials through the /debug endpoint. This endpoint exposes cleartext credentials that are used to authenticate to the AS400 system, which is a critical component of the ERP infrastructure. The exposure of these credentials violates security best practices that require sensitive authentication information to be properly secured. An attacker who gains access to these credentials could potentially authenticate to the AS400 system, potentially leading to unauthorized access to sensitive business data, system manipulation, or further privilege escalation within the network.
Remediation
Organizations using Sme.UP ERP TOKYO V6R1M220406 should take the following actions:
- Disable or restrict access to the /debug endpoint immediately
- Apply any security patches or updates provided by Sme.UP for this vulnerability
- Change all AS400 authentication credentials that may have been exposed
- Implement network segmentation to limit access to the ERP system
- Monitor for any suspicious authentication attempts to the AS400 system
- Consider implementing multi-factor authentication for AS400 access if available
- Contact Sme.UP support for specific guidance related to this vulnerability
References
- Swascan Security Advisory for Sme.UP ERP: https://www.swascan.com/it/security-advisory-sme-up-erp/
- CWE-312: Cleartext Storage of Sensitive Information: https://cwe.mitre.org/data/definitions/312.html
- MITRE CVE-2023-26760: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26760
Industry ExposureMost to leastThis section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
- Accommodation & Food ServicesAccommodation & Food Services
- Administrative, Support, Waste Management & Remediation ServicesAdministrative, Support, Waste Management & Remediation Services
- Agriculture, Forestry Fishing & HuntingAgriculture, Forestry Fishing & Hunting
- Arts, Entertainment & RecreationArts, Entertainment & Recreation
- ConstructionConstruction
- Educational ServicesEducational Services
- Finance and InsuranceFinance and Insurance
- Health Care & Social AssistanceHealth Care & Social Assistance
- InformationInformation
- Management of Companies & EnterprisesManagement of Companies & Enterprises
- ManufacturingManufacturing
- MiningMining
- Other Services (except Public Administration)Other Services (except Public Administration)
- Professional, Scientific, & Technical ServicesProfessional, Scientific, & Technical Services
- Public AdministrationPublic Administration
- Real Estate Rental & LeasingReal Estate Rental & Leasing
- Retail TradeRetail Trade
- Transportation & WarehousingTransportation & Warehousing
- UtilitiesUtilities
- Wholesale TradeWholesale Trade
