Lucene search

INCIBECVE-2023-3768

HistoryOct 02, 2023 - 11:15 a.m.

CVE-2023-3768

2023-10-0211:15:50

CWE-20

INCIBE

web.nvd.nist.gov

cve-2023-3768

mms protocol

data input validation

vulnerability

dos

system reboot

network security

nvd

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

AI Score

7.6

Confidence

High

EPSS

0.001

Percentile

23.6%

JSON

Incorrect data input validation vulnerability, which could allow an attacker with access to the network to implement fuzzing techniques that would allow him to gain knowledge about specially crafted packets that would create a DoS condition through the MMS protocol when initiating communication, achieving a complete system reboot of the device and its services.

Affected configurations

Nvd

Vulners

Node

ingeteamingepac_da3451_firmwareMatch-

AND

ingeteamingepac_da3451Match-

Node

ingeteamingepac_ef_md_firmwareMatch-

AND

ingeteamingepac_ef_mdMatch-

Node

ingeteamingepac_fc5066_firmwareMatch-

AND

ingeteamingepac_fc5066Match-

VendorProductVersionCPE
ingeteamingepac_da3451_firmware-cpe:2.3:o:ingeteam:ingepac_da3451_firmware:-:*:*:*:*:*:*:*
ingeteamingepac_da3451-cpe:2.3:h:ingeteam:ingepac_da3451:-:*:*:*:*:*:*:*
ingeteamingepac_ef_md_firmware-cpe:2.3:o:ingeteam:ingepac_ef_md_firmware:-:*:*:*:*:*:*:*
ingeteamingepac_ef_md-cpe:2.3:h:ingeteam:ingepac_ef_md:-:*:*:*:*:*:*:*
ingeteamingepac_fc5066_firmware-cpe:2.3:o:ingeteam:ingepac_fc5066_firmware:-:*:*:*:*:*:*:*
ingeteamingepac_fc5066-cpe:2.3:h:ingeteam:ingepac_fc5066:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ingeteam	ingepac_da3451_firmware	-	cpe:2.3:o:ingeteam:ingepac_da3451_firmware:-:::::::*
ingeteam	ingepac_da3451	-	cpe:2.3:h:ingeteam:ingepac_da3451:-:::::::*
ingeteam	ingepac_ef_md_firmware	-	cpe:2.3:o:ingeteam:ingepac_ef_md_firmware:-:::::::*
ingeteam	ingepac_ef_md	-	cpe:2.3:h:ingeteam:ingepac_ef_md:-:::::::*
ingeteam	ingepac_fc5066_firmware	-	cpe:2.3:o:ingeteam:ingepac_fc5066_firmware:-:::::::*
ingeteam	ingepac_fc5066	-	cpe:2.3:h:ingeteam:ingepac_fc5066:-:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "INGEPAC DA3451",
    "vendor": "Ingeteam",
    "versions": [
      {
        "status": "affected",
        "version": "0.29.2.42"
      }
    ]
  }
]

References

www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ingeteam-products

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

AI Score

7.6

Confidence

High

EPSS

0.001

Percentile

23.6%

JSON

Related for CVE-2023-3768