Lucene search

PRIOn knowledge basePRION:CVE-2023-44318

HistoryNov 14, 2023 - 11:15 a.m.

Hardcoded credentials

2023-11-1411:15:00

PRIOn knowledge base

www.prio-n.com

hardcoded credentials

configuration backup

obfuscate

administrative privileges

attacker

4.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

5.7 Medium

AI Score

Confidence

High

3.3 Low

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:M/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

22.6%

JSON

Affected devices use a hardcoded key to obfuscate the configuration backup that an administrator can export from the device. This could allow an authenticated attacker with administrative privileges or an attacker that obtains a configuration backup to extract configuration information from the exported file.

CPENameOperatorVersion
6ag1206-2bb00-7ac2_firmwarelt4.5
6ag1206-2bs00-7ac2_firmwarelt4.5
6ag1208-0ba00-7ac2_firmwarelt4.5
6ag1216-4bs00-7ac2_firmwarelt4.5
6gk5204-0ba00-2gf2_firmwarelt4.5
6gk5204-0ba00-2yf2_firmwarelt4.5
6gk5204-2aa00-2gf2_firmwarelt4.5
6gk5204-2aa00-2yf2_firmwarelt4.5
6gk5205-3bb00-2ab2_firmwarelt4.5
6gk5205-3bb00-2tb2_firmwarelt4.5

Name	Operator	Version
6ag1206-2bb00-7ac2_firmware	lt	4.5
6ag1206-2bs00-7ac2_firmware	lt	4.5
6ag1208-0ba00-7ac2_firmware	lt	4.5
6ag1216-4bs00-7ac2_firmware	lt	4.5
6gk5204-0ba00-2gf2_firmware	lt	4.5
6gk5204-0ba00-2yf2_firmware	lt	4.5
6gk5204-2aa00-2gf2_firmware	lt	4.5
6gk5204-2aa00-2yf2_firmware	lt	4.5
6gk5205-3bb00-2ab2_firmware	lt	4.5
6gk5205-3bb00-2tb2_firmware	lt	4.5

Rows per page:

1-10 of 711

References

cert-portal.siemens.com/productcert/html/ssa-180704.html

cert-portal.siemens.com/productcert/html/ssa-353002.html

cert-portal.siemens.com/productcert/pdf/ssa-180704.pdf

cert-portal.siemens.com/productcert/pdf/ssa-699386.pdf

4.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

5.7 Medium

AI Score

Confidence

High

3.3 Low

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:M/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

22.6%

JSON

Related for PRION:CVE-2023-44318