Directory Listing Exposure in CONPROSYS M2M Gateway Series

Executive Summary

This vulnerability is an exposure of information through directory listing in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. It allows a remote unauthenticated attacker to access a specific URL and obtain a directory list without needing authentication.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if directory listing is enabled on CONPROSYS M2M Gateway or Controller Series by accessing URLs like http://[target]/[directory]/ on your network. Use tools like curl or wget to request specific paths and observe if directory contents are returned without authentication.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to view sensitive directory contents, potentially exposing configuration files, logs, or other sensitive data stored on the device. This may lead to further attacks if critical files are accessible.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Disable directory listing in the web server configuration for affected CONPROSYS products. Apply patches or updates from the vendor if available. Restrict network access to the device using firewalls or network segmentation until mitigation is complete.

Useful 0 Not Useful 0