CVE-2023-27462

Published Mar 14, 2023

Last updated 2 years ago

CVSS medium 4.3

Overview

Description: A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.3). The client query handler of the affected application fails to check for proper permissions for specific read queries. This could allow authenticated remote attackers to access data they are not authorized for.
Source: productcert@siemens.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 4.3
Impact score: 1.4
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Severity: MEDIUM

Weaknesses

productcert@siemens.com: CWE-862

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:siemens:ruggedcom_crossbow:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C2CBB4F0-C72F-4816-94A2-782AFEEE8AD8",
            "versionEndExcluding": "5.3"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References