The web interface of ATX Ucrypt (v3.5 and older) is vulnerable to a Server Side Request Forgery (SSRF) and Local File Inclusion (LFI) vulnerability, allowing authenticated users (or attackers using default credentials for the admin, master or user account) to access remote hosts and system files.
ATX Ucrypt v3.5 and older
An authenticated user, or an attacker using the default credentials for the admin, master or user account, can access remote web endpoints or local system files using the following URIs :
An example of a vulnerable host :
Multiple attempts had been made to responsibly disclose the issue to the vendor to address the root cause of this vulnerability, but no response was received.
Users are advised to audit all users of their deployment and ensure that they have rotated the default credentials for the
user accounts that this service has baked in.
|Jul 18, 2023||First attempt made to contact ATX Networks on their marketing and security email.|
|Aug 15, 2023||Second attempt made to contact ATX Networks on their marketing and security email.|
|Aug 19, 2023||Case opened with CERT Coordination Center (CERT/CC) to assist with responsible disclosure.|
|Aug 21, 2023||CERT/CC’s time window to responsible disclosure begins (Case VU#293164).|
|Oct 05, 2023||Two attempts made by CERT/CC in the window receive no response and 45 day window ends.|
|Oct 05, 2023||CVE number assigned by MITRE.|
|Oct 07, 2023||Responsible public disclosure.|