Lucene search

[email protected]CVE-2023-0897

HistoryOct 26, 2023 - 8:15 p.m.

CVE-2023-0897

2023-10-2620:15:08

CWE-384

[email protected]

web.nvd.nist.gov

cve-2023-0897

sielco polyeco1000

session hijack

cookie vulnerability

brute force attack

ssl

security vulnerability

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.3%

JSON

Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session being visible in requests.

Affected configurations

NVD

Node

sielcopolyeco500_firmwareMatch1.7.0cpu

sielcopolyeco500_firmwareMatch10.16fpga

AND

sielcopolyeco500Match-

Node

sielcopolyeco300_firmwareMatch2.0.0cpu

sielcopolyeco300_firmwareMatch2.0.2cpu

sielcopolyeco300_firmwareMatch10.19fpga

AND

sielcopolyeco300Match-

Node

sielcopolyeco1000_firmwareMatch1.9.3cpu

sielcopolyeco1000_firmwareMatch1.9.4cpu

sielcopolyeco1000_firmwareMatch2.0.6cpu

sielcopolyeco1000_firmwareMatch10.19fpga

AND

sielcopolyeco1000Match-

CPENameOperatorVersion
sielco:polyeco500_firmwaresielco polyeco500 firmwareeq1.7.0
sielco:polyeco500_firmwaresielco polyeco500 firmwareeq10.16

CPE	Name	Operator	Version
sielco:polyeco500_firmware	sielco polyeco500 firmware	eq	1.7.0
sielco:polyeco500_firmware	sielco polyeco500 firmware	eq	10.16

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "PolyEco1000",
    "vendor": "Sielco ",
    "versions": [
      {
        "status": "affected",
        "version": "CPU:2.0.6 FPGA:10.19"
      },
      {
        "status": "affected",
        "version": "CPU:1.9.4 FPGA:10.19"
      },
      {
        "status": "affected",
        "version": "CPU:1.9.3 FPGA:10.19"
      },
      {
        "status": "affected",
        "version": "CPU:1.7.0 FPGA:10.16"
      },
      {
        "status": "affected",
        "version": "CPU:2.0.2 FPGA:10.19"
      },
      {
        "status": "affected",
        "version": "CPU:2.0.0 FPGA:10.19"
      }
    ]
  }
]