Lucene search

IcscertCVELIST:CVE-2023-34441

HistoryOct 18, 2023 - 11:22 p.m.

CVE-2023-34441 Baker Hughes Bently Nevada 3500 System Cleartext Transmission of Sensitive Information

2023-10-1823:22:29

CWE-319

icscert

www.cve.org

baker hughes

bently nevada 3500

tdi firmware

cleartext transmission

vulnerability

authentication secret

communication traffic

CVSS3

6.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

AI Score

8.5

Confidence

High

EPSS

0.001

Percentile

40.6%

JSON

Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05

contains a cleartext transmission vulnerability which could allow an attacker to

steal the authentication secret from communication traffic to the device and reuse it for arbitrary requests.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Bently Nevada 3500 System",
    "vendor": "Baker Hughes - Bently Nevada",
    "versions": [
      {
        "status": "affected",
        "version": "5.05"
      }
    ]
  }
]

References

www.cisa.gov/news-events/ics-advisories/icsa-23-269-05