Directory Listing Exposure in CONPROSYS PAC Series

Executive Summary

This vulnerability is an exposure of information through directory listing in CONPROSYS PAC Series. It allows a remote unauthenticated attacker to access a specific URL and obtain a directory list without needing authentication.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if directory listing is enabled on CONPROSYS PAC Series devices by accessing URLs like /cgi-bin/ or /htdocs/ via web browser or tools like curl. Example: curl -I http://<target-ip>/cgi-bin/

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to view sensitive directory contents, potentially exposing files or system information that could aid further attacks. This may lead to unauthorized data access or system compromise depending on the exposed data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by exposing sensitive data without authorization. Organizations may face penalties for failing to protect personal or health information due to insufficient access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Disable directory listing in the web server configuration of CONPROSYS PAC Series devices. Restrict access to sensitive URLs and ensure authentication is required for all administrative interfaces.

Useful 0 Not Useful 0