Lucene search

SiemensCVE-2023-27408

HistoryMay 09, 2023 - 1:15 p.m.

CVE-2023-27408

2023-05-0913:15:16

CWE-378

siemens

web.nvd.nist.gov

vulnerability

scalance lpe9403

i2c

mutex

permissions

ssh

interface

authenticated attacker

nvd

CVSS3

3.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

3.9

Confidence

High

EPSS

Percentile

9.0%

JSON

A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). The i2c mutex file is created with the permissions bits of -rw-rw-rw-. This file is used as a mutex for multiple applications interacting with i2c. This could allow an authenticated attacker with access to the SSH interface on the affected device to interfere with the integrity of the mutex and the data it protects.

Affected configurations

Nvd

Node

siemensscalance_lpe9403_firmwareRange<2.1

AND

siemensscalance_lpe9403Match-

VendorProductVersionCPE
siemensscalance_lpe9403_firmware*cpe:2.3:o:siemens:scalance_lpe9403_firmware:*:*:*:*:*:*:*:*
siemensscalance_lpe9403-cpe:2.3:h:siemens:scalance_lpe9403:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
siemens	scalance_lpe9403_firmware	*	cpe:2.3:o:siemens:scalance_lpe9403_firmware::::::::
siemens	scalance_lpe9403	-	cpe:2.3:h:siemens:scalance_lpe9403:-:::::::*

CNA Affected

[
  {
    "vendor": "Siemens",
    "product": "SCALANCE LPE9403",
    "versions": [
      {
        "version": "All versions < V2.1",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

cert-portal.siemens.com/productcert/pdf/ssa-325383.pdf

CVSS3

3.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

3.9

Confidence

High

EPSS

Percentile

9.0%

JSON

Related for CVE-2023-27408