PT-2023-20041 · Tyan · Tyan S5552 Bmc

Andrea Palanca · Published 2023-07-05 · Updated 2024-09-30 · CVE-2023-2538

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Tyan S5552 BMC version 3.00

Description A CWE-552 issue in the web interface allows an unauthenticated remote attacker to retrieve the private key of the TLS certificate in use by the BMC via forced browsing. This can be abused to perform Man-in-the-Middle (MitM) attacks against victims accessing the web interface through HTTPS.

Recommendations For Tyan S5552 BMC version 3.00, consider restricting access to the web interface until a patch is available to prevent exploitation. As a temporary workaround, limit access to the BMC's web interface to minimize the risk of MitM attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2023-2538

Affected Products

Tyan S5552 Bmc

References · 4

• https://osv.dev/vulnerability/CVE-2023-2538 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2538 · Security Note
• https://t.me/cibsecurity/65967 · Telegram Post
• https://nozominetworks.com/labs/vulnerability-advisories-cve-2023-2538 · Note