PT-2023-21845 · Omicron · Omicron Stationscout+1

Hendrik Schwartke · Published 2023-03-23 · Updated 2023-03-28 · CVE-2023-28610

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OMICRON StationGuard versions prior to 2.21 OMICRON StationScout versions prior to 2.21

Description The update process can be exploited by providing a modified firmware update image, allowing a remote attacker to gain root access to the system.

Recommendations For OMICRON StationGuard versions prior to 2.21, update to version 2.21 or later to resolve the issue. For OMICRON StationScout versions prior to 2.21, update to version 2.21 or later to resolve the issue.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2023-28610

Affected Products

Omicron Stationguard

Omicron Stationscout

References · 6

• https://omicronenergy.com/fileadmin/user_upload/website/files/product-security/osa-5.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28610 · Security Note
• https://omicronenergy.com/en/support/product-security · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28610 · Vendor Advisory
• https://t.me/cibsecurity/60589 · Telegram Post
• https://t.me/cvenotify/46945 · Telegram Post