Description
Deep Sea Electronics DSE855 是一款允许通过 LAN 或 WAN 连接监控 DSE 控制器的通信设备。Deep Sea Electronics DSE855 配置备份文件缺少身份验证，导致攻击者可下载并查看用户名密码等敏感信息。
Deep Sea Electronics DSE855 /Backup.bin 信息泄露漏洞 （CVE-2024-5947）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-5947
https://www.zerodayinitiative.com/advisories/ZDI-24-671/
https://infosecwriteups.com/the-discovery-of-cve-2024-5947-authentication-bypass-in-deep-sea-electronics-dse855-5fa2e89cbdfb
https://github.com/Cappricio-Securities/CVE-2024-5947
https://www.thezdi.com/blog/2024/7/25/multiple-vulnerabilities-in-the-deep-sea-electronics-dse855
https://blogs.cappriciosec.com/cve/214/Deep%20Sea%20Electronics%20DSE855%20Configuration%20Backup%20Vulnerability%20Exposing%20Sensitive%20Information%20(CVE-2024-5947)
https://cn-sec.com/archives/2949840.html
https://s4e.io/tools/deep-sea-electronics-dse855-information-disclosure-cve-2024-5947
https://sploitus.com/exploit?id=1337DAY-ID-39675
https://www.deepseaelectronics.com/genset/remote-communications-overview-displays/dse855