Multiple vulnerabilities in Össur Logic Application



Risk High
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2024-53683
CVE-2024-54681
CVE-2024-45832
CWE-ID CWE-497
CWE-77
CWE-798
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Össur Logic
Mobile applications / Apps for mobile phones

Vendor Össur

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Exposure of Sensitive System Information to an Unauthorized Control Sphere

EUVDB-ID: #VU102457

Risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53683

CWE-ID: CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

Exploit availability: No

Description

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to the valid set of credentials in a .js file and a static token for communication are obtained from the decompiled IPA. A local administrator can change the translation files, use the information to disrupt normal use of the application and weaken the integrity of normal use.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Össur Logic: before 1.5.5

CPE2.3 External links

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-354-01


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to perform certain actions on the device.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Command Injection

EUVDB-ID: #VU102461

Risk: High

CVSSv4.0: 5.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-54681

CWE-ID: CWE-77 - Command injection

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The vulnerability exists due to multiple bash files are present in the application's private directory. A remote user can pass specially crafted data to the application and execute arbitrary commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Össur Logic: before 1.5.5

CPE2.3 External links

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-354-01


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to perform certain actions on the device.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Use of hard-coded credentials

EUVDB-ID: #VU102462

Risk: Low

CVSSv4.0: 0.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-45832

CWE-ID: CWE-798 - Use of Hard-coded Credentials

Exploit availability: No

Description

The vulnerability allows a local attacker to compromise the target system.

The vulnerability exists due to presence of hard-coded credentials in application code. An attacker with physical access can access the affected system and gain access unauthorized information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Össur Logic: before 1.5.5

CPE2.3 External links

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-354-01


Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to perform certain actions on the device.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###