PT-2023-24876 · Baker Hughes · Bently Nevada 3500 System Tdi Firmware

Diego Zaffaroni · Published 2023-10-18 · Updated 2024-11-13 · CVE-2023-34437

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05

Description The issue concerns a vulnerability in the password retrieval functionality, which could allow an attacker to access passwords stored on the device.

Recommendations For Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05, consider disabling the password retrieval functionality until a patch is available. Restrict access to the device to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Information Disclosure

Weakness Enumeration

CWE-732

CWE-200

Related Identifiers

CVE-2023-34437

Affected Products

Bently Nevada 3500 System Tdi Firmware

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-34437 · Security Note
• https://osv.dev/vulnerability/CVE-2023-34437 · Vendor Advisory
• https://twitter.com/CVEnew/status/1714787914083618933 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-269-05 · Note
• https://t.me/cibsecurity/72549 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1714881307627418111 · Twitter Post
• https://t.me/cvenotify/101545 · Telegram Post