Miniserver Go Gen 2 Firmware vulnerabilities

3 known vulnerabilities in Miniserver Go Gen 2 Firmware from Loxone. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  miniserver_go_gen_2: Missing Authorization

  CVE-2023-36624Jul 5, 2023Loxone

  Loxone Miniserver Go Gen.2 through 14.0.3.28 allows an authenticated operating system user to escalate privileges via the Sudo configuration. This allows the elevated execution of binaries without a password requirement.

• 7.8 High severity

  miniserver_go_gen_2: Use of Hard-coded Credentials

  CVE-2023-36623Jul 5, 2023Loxone

  The root password of the Loxone Miniserver Go Gen.2 before 14.2 is calculated using hard-coded secrets and the MAC address. This allows a local user to calculate the root password and escalate privileges.

• 7.2 High severity

  miniserver_go_gen_2: Improper Neutralization of Special Elements used in an OS Command

  CVE-2023-36622Jul 5, 2023LoxoneEPSS 1.37%

  The websocket configuration endpoint of the Loxone Miniserver Go Gen.2 before 14.1.5.9 allows remote authenticated administrators to inject arbitrary OS commands via the timezone parameter.