SITEL CAP/PRX information exposure
CAP/PRX firmware version 5.2.01.
INCIBE has coordinated the publication of a vulnerability in the SITEL CAP/PRX device, with the internal code INCIBE-2021-0178, which has been discovered by the Industrial Cybersecurity team of S21sec, special mention to Aarón Flecha Menéndez and Luis Martín Liras, as an independent researcher.
CVE-2021-32453 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.5 has been calculated; the CVSS vector string is AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
The fix for this vulnerability is available as of version 1.2 of the CAP-PRX-NG platform.
It is possible to access via HTTP to the internal database of configuration of the device. It is also possible to access different configuration files that provide information about the device and its operative system.
An attacker with access to the local network where the device is located, could download the database and obtain information about the device´s configuration.
This vulnerability has been corrected in the affected products through SITEL's continuous improvement processes.
CWE-306: Missing Authentication for Critical Function.
TIMELINE:
11/08/2017 – Researchers disclosure.
02/10/2020 – Researchers contact with INCIBE.
08/02/2021 – SITEL confirms the vulnerability to INCIBE and the publication of the corrective version and the new software version (security patch).
13/05/20201 – INCIBE publishes the advisory.
If you have any information regarding this advisory, please contact INCIBE as indicated in the CVE Assignment and publication section.
