Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveSEC-VLabCVE-2023-6269
HistoryDec 05, 2023 - 8:15 a.m.

CVE-2023-6269

2023-12-0508:15:08
CWE-88
SEC-VLab
web.nvd.nist.gov
24
cve-2023-6269
atos
unify
openscape
sbc
branch
bcf
vulnerability
authentication bypass
ssh
root access

CVSS3

10

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.9

Confidence

High

EPSS

0.001

Percentile

28.5%

JSON

An argument injection vulnerability has been identified in the
administrative web interface of the Atos Unify OpenScape products “Session Border Controller” (SBC) and “Branch”, before version V10 R3.4.0, and OpenScape “BCF” before versions V10R10.12.00 and V10R11.05.02. This allows an
unauthenticated attacker to gain root access to the appliance via SSH (scope change) and also bypass authentication for the administrative interface and gain
access as an arbitrary (administrative) user.

Affected configurations

Nvd
Node
atosunify_openscape_bcfRange10–10r10.12.00
OR
atosunify_openscape_branchRange10–10r3.4.0
OR
atosunify_openscape_session_border_controllerRange10–10r3.4.0
VendorProductVersionCPE
atosunify_openscape_bcf*cpe:2.3:a:atos:unify_openscape_bcf:*:*:*:*:*:*:*:*
atosunify_openscape_branch*cpe:2.3:a:atos:unify_openscape_branch:*:*:*:*:*:*:*:*
atosunify_openscape_session_border_controller*cpe:2.3:a:atos:unify_openscape_session_border_controller:*:*:*:*:*:*:*:*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "OpenScape Session Border Controller (SBC)",
    "vendor": "Atos Unify",
    "versions": [
      {
        "lessThan": "V10 R3.4.0",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "OpenScape Branch",
    "vendor": "Atos Unify",
    "versions": [
      {
        "lessThan": "V10 R3.4.0",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "OpenScape BCF",
    "vendor": "Atos Unify",
    "versions": [
      {
        "lessThan": "V10 R10.12.00",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThan": "V10R 11.05.02",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Related

nvd 1
prion 1
cvelist 1
packetstorm 1
nvd
nvd
CVE-2023-6269
2023-12-05 08:15:08
prion
prion
Authentication flaw
2023-12-05 08:15:00
cvelist
cvelist
CVE-2023-6269 Argument injection vulnerability in Atos Unify OpenScape Session Border Controller, Atos Unify OpenScape Branch and Atos Unify OpenScape BCF
2023-12-05 07:35:19
packetstorm
packetstorm
Atos Unify OpenScape Authentication Bypass / Remote Code Execution
2023-12-13 00:00:00

CVSS3

10

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.9

Confidence

High

EPSS

0.001

Percentile

28.5%

JSON
Related for CVE-2023-6269
nvd1prion1cvelist1packetstorm1