A CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Teli…

published 2023-11-09 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-51723

cvss: 6.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 28%
public exploits: 0; none known

A CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow an attacker with physical access to the target system to obtain a read/write access to any files and directories on the targeted system, including hidden files and directories.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-25-100-09 updated 2025-04-07 cvss 6.8

ABB Arctic Wireless Gateways

ABB Arctic Wireless Gateways
affected: mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 y ago (2024-09-04)

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.8	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	6.1	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

Telit Cinterion BGS5
Telit Cinterion EHS5
Telit Cinterion EHS6
Telit Cinterion EHS8
Telit Cinterion PDS5
Telit Cinterion PDS6
Telit Cinterion PDS8
Telit Cinterion ELS61
Telit Cinterion ELS81
Telit Cinterion PLS62
telit_cinterion bgs5
telit_cinterion ehs5
telit_cinterion ehs6
telit_cinterion ehs8
telit_cinterion pds5
telit_cinterion pds6
telit_cinterion pds8
telit_cinterion els61
telit_cinterion els81
telit_cinterion pls62

Classification

Weakness

CWE-552 Files or Directories Accessible to External Parties

References

ics-cert.kaspersky.com /advisories/2023/11/08/klcert-22-194-telit-cinterion-thales-gemalto-modules-files-or-directories-accessible-to
third-party-advisory

Sources

CVE List CVE-2023-47612
NVD CVE-2023-47612

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary