PT-2023-1880 · Siemens · Ruggedcom Crossbow

Published 2023-03-14 · Updated 2023-03-17 · CVE-2023-27310

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RUGGEDCOM CROSSBOW versions prior to V5.2

Description A vulnerability has been identified in the client query handler of the affected application, which fails to check for proper permissions when assigning groups to user accounts. This could allow an authenticated remote attacker to assign administrative groups to otherwise non-privileged user accounts, potentially allowing the attacker to elevate their privileges by adding user accounts to administrative groups.

Recommendations For versions prior to V5.2, update to version V5.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the client query handler to minimize the risk of exploitation. Additionally, restrict the ability to assign administrative groups to user accounts until the issue is resolved.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2023-01481

CVE-2023-27310

Affected Products

Ruggedcom Crossbow

References · 4

• https://bdu.fstec.ru/vul/2023-01481 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-27310 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-260625.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-27310 · Vendor Advisory