PT-2023-1881 · Unknown · Ruggedcom Crossbow

Published 2023-03-14 · Updated 2023-03-17 · CVE-2023-27462

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RUGGEDCOM CROSSBOW versions prior to V5.3

Description A vulnerability has been identified in the client query handler of the affected application, which fails to check for proper permissions for specific read queries. This could allow authenticated remote attackers to access data they are not authorized for. The issue is related to shortcomings in the authorization procedure, which may enable a remote attacker to gain unauthorized access to protected information.

Recommendations For versions prior to V5.3, update to version V5.3 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data and implementing additional authorization checks to minimize the risk of exploitation.

Fix

Missing Authorization

SQL injection

Weakness Enumeration

CWE-862

CWE-89

Related Identifiers

BDU:2023-01482

BDU:2023-01483

CVE-2023-27462

Affected Products

Ruggedcom Crossbow

References · 7

• https://osv.dev/vulnerability/CVE-2023-27462 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-320629.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27462 · Security Note
• https://bdu.fstec.ru/vul/2023-01483 · Security Note
• https://bdu.fstec.ru/vul/2023-01482 · Security Note
• https://support.industry.siemens.com/cs/document/109813558/delivery-release-for-ruggedcom-crossbow-5-3?dti=0&lc=en-WW · Note
• https://support.industry.siemens.com/cs/document/109813558/delivery-release-for-ruggedcom-crossbow-5-3?dti=0&lc=en-WW · Note