Improper Input Validation in Meinberg LTOS
Priority LOW 36CWE-434Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
In Meinbergs LTOS versions prior to V7.06.013, the configuration file upload function would not correctly validate the input, which would allow an remote authenticated attacker with high privileges to execute arbitrary commands.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0097 62nd percentileScored 2026-11-07
Fix Fixed LTOS (Meinberg): 7.06.013
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Meinberg | LTOS | 0.0.0 to before 7.06.013 | 7.06.013 | Patch available | CNA |
- LTOS VendorMeinberg Affected 0.0.0 to before 7.06.013 Fixed in 7.06.013 Patch available CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:meinbergglobal:lantime_firmware:*:*:*:*:*:*:*:* | before 7.06.013 | Vulnerable | Meinbergglobal |
| cpe:2.3:h:meinbergglobal:lantime_m100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Meinbergglobal |
| cpe:2.3:h:meinbergglobal:lantime_m200:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Meinbergglobal |
| cpe:2.3:h:meinbergglobal:lantime_m300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Meinbergglobal |
| cpe:2.3:h:meinbergglobal:lantime_m400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Meinbergglobal |
| cpe:2.3:h:meinbergglobal:lantime_m600:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Meinbergglobal |
| cpe:2.3:h:meinbergglobal:lantime_m900:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Meinbergglobal |
- cpe:2.3:o:meinbergglobal:lantime_firmware:*:*:*:*:*:*:*:* Versions before 7.06.013 Vulnerable ·Meinbergglobal
- cpe:2.3:h:meinbergglobal:lantime_m100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Meinbergglobal
- cpe:2.3:h:meinbergglobal:lantime_m200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Meinbergglobal
- cpe:2.3:h:meinbergglobal:lantime_m300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Meinbergglobal
- cpe:2.3:h:meinbergglobal:lantime_m400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Meinbergglobal
- cpe:2.3:h:meinbergglobal:lantime_m600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Meinbergglobal
- cpe:2.3:h:meinbergglobal:lantime_m900:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Meinbergglobal
Remediation
- Fix · CNA LTOS (Meinberg) Fixed in 7.06.013
Timeline
- 2026-10-02 Threatist record created from CVE-2023-1731
- 2026-10-03 Alias added: GHSA-7j3x-mrc3-42pg
References
More Meinberg vulnerabilities
- TI-2016-03390 The NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000… CVSS 3.0HIGH 8.1
- TI-2016-03368 Stack-based buffer overflow in the NTP time-server interface on Meinberg IMS-LANTIME… CVSS 3.0HIGH 7.3
- TI-2014-04416 Cross-site scripting in Meinberg Radio Clocks LANTIME M-Series CVSS 2.0HIGH 7.5
- TI-2016-03389 Multiple stack-based buffer overflows in the NTP time-server interface on Meinberg… CVSS 3.0HIGH 7.3
Sources
- CVE-2023-1731 · CVE Program
- CVE-2023-1731 · NVD
- FIRST EPSS
- GHSA-7j3x-mrc3-42pg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences