Lucene search

INCIBECVELIST:CVE-2023-0321

HistoryJan 25, 2023 - 12:00 a.m.

CVE-2023-0321 Disclosure of Sensitive Information on Campbell Scientific Products

2023-01-2500:00:00

CWE-200

INCIBE

www.cve.org

campbell scientific

dataloggers

sensitive information

configuration files

http

pakbus

exploitation

vulnerability

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

9.2

Confidence

High

EPSS

0.001

Percentile

49.3%

JSON

Campbell Scientific dataloggers CR6, CR300, CR800, CR1000 and CR3000 may allow an attacker to download configuration files, which may contain sensitive information about the internal network. From factory defaults, the mentioned datalogges have HTTP and PakBus enabled. The devices, with the default configuration, allow this situation via the PakBus port. The exploitation of this vulnerability may allow an attacker to download, modify, and upload new configuration files.

CNA Affected

[
  {
    "vendor": "Campbell Scientific",
    "product": "CR6",
    "versions": [
      {
        "version": "all version",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Campbell Scientific",
    "product": "CR300",
    "versions": [
      {
        "version": "all version",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Campbell Scientific",
    "product": "CR800",
    "versions": [
      {
        "version": "all version",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Campbell Scientific",
    "product": "CR1000",
    "versions": [
      {
        "version": "all version",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Campbell Scientific",
    "product": "CR3000",
    "versions": [
      {
        "version": "all version",
        "status": "affected"
      }
    ]
  }
]

References

www.hackplayers.com/2023/01/cve-2023-0321-info-sensible-campbell.html

www.incibe-cert.es/en/early-warning/ics-advisories/disclosure-sensitive-information-campbell-scientific-products

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

9.2

Confidence

High

EPSS

0.001

Percentile

49.3%

JSON

Related for CVELIST:CVE-2023-0321