Lucene search

PRIOn knowledge basePRION:CVE-2023-44374

HistoryNov 14, 2023 - 11:15 a.m.

Default credentials

2023-11-1411:15:00

PRIOn knowledge base

www.prio-n.com

default credentials

unauthorized access

insufficient checks

privilege escalation.

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

25.3%

JSON

Affected devices allow to change the password, but insufficiently check which password is to be changed. With this an authenticated attacker could, under certain conditions, be able to change the password of another, potential admin user allowing her to escalate her privileges.

CPENameOperatorVersion
6ag1206-2bb00-7ac2_firmwarelt4.5
6ag1206-2bs00-7ac2_firmwarelt4.5
6ag1208-0ba00-7ac2_firmwarelt4.5
6ag1216-4bs00-7ac2_firmwarelt4.5
6gk5204-0ba00-2gf2_firmwarelt4.5
6gk5204-0ba00-2yf2_firmwarelt4.5
6gk5204-2aa00-2gf2_firmwarelt4.5
6gk5204-2aa00-2yf2_firmwarelt4.5
6gk5205-3bb00-2ab2_firmwarelt4.5
6gk5205-3bb00-2tb2_firmwarelt4.5

Name	Operator	Version
6ag1206-2bb00-7ac2_firmware	lt	4.5
6ag1206-2bs00-7ac2_firmware	lt	4.5
6ag1208-0ba00-7ac2_firmware	lt	4.5
6ag1216-4bs00-7ac2_firmware	lt	4.5
6gk5204-0ba00-2gf2_firmware	lt	4.5
6gk5204-0ba00-2yf2_firmware	lt	4.5
6gk5204-2aa00-2gf2_firmware	lt	4.5
6gk5204-2aa00-2yf2_firmware	lt	4.5
6gk5205-3bb00-2ab2_firmware	lt	4.5
6gk5205-3bb00-2tb2_firmware	lt	4.5

Rows per page:

1-10 of 711

References

cert-portal.siemens.com/productcert/html/ssa-180704.html

cert-portal.siemens.com/productcert/html/ssa-699386.html

cert-portal.siemens.com/productcert/pdf/ssa-180704.pdf

cert-portal.siemens.com/productcert/pdf/ssa-699386.pdf

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

25.3%

JSON

Related for PRION:CVE-2023-44374