Lucene search

ZdiCVE-2023-39458

HistoryMay 03, 2024 - 3:15 a.m.

CVE-2023-39458

2024-05-0303:15:10

CWE-798

zdi

web.nvd.nist.gov

cve-2023-39458

authentication bypass

ssl certificate

triangle microworks

scada data gateway

network-adjacent attackers

exploit

handling of certificates

zdi-can-20509

CVSS3

5.3

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

5.4

Confidence

High

EPSS

0.001

Percentile

16.2%

JSON

Triangle MicroWorks SCADA Data Gateway Use of Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Triangle MicroWorks SCADA Data Gateway. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of certificates. The service uses a hard-coded default SSL certificate. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-20509.

Affected configurations

Vulners

Vulnrichment

Node

triangle_microworksscada_data_gatewayRange≤5.1.3.20324

VendorProductVersionCPE
triangle_microworksscada_data_gateway*cpe:2.3:a:triangle_microworks:scada_data_gateway:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
triangle_microworks	scada_data_gateway	*	cpe:2.3:a:triangle_microworks:scada_data_gateway::::::::

CNA Affected

[
  {
    "vendor": "Triangle MicroWorks",
    "product": "SCADA Data Gateway",
    "versions": [
      {
        "version": "5.1.3.20324",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

www.trianglemicroworks.com/products/scada-data-gateway/what's-new

www.zerodayinitiative.com/advisories/ZDI-23-1026/

CVSS3

5.3

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

5.4

Confidence

High

EPSS

0.001

Percentile

16.2%

JSON

Related for CVE-2023-39458