CVE-2023-27462

Published Mar 14, 2023

Last updated 2 years ago

Overview

Description: A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.3). The client query handler of the affected application fails to check for proper permissions for specific read queries. This could allow authenticated remote attackers to access data they are not authorized for.
Source: productcert@siemens.com
NVD status: Analyzed

Hype score: Not currently trending

Risk scores

CVSS 3.1

Type: Primary
Base score: 4.3
Impact score: 1.4
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Severity: MEDIUM

Weaknesses

productcert@siemens.com: CWE-862

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:siemens:ruggedcom_crossbow:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C2CBB4F0-C72F-4816-94A2-782AFEEE8AD8",
            "versionEndExcluding": "5.3"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References