PT-2023-29015 · Net2 · Net2

Published 2023-12-19 · Updated 2024-06-10 · CVE-2023-43870

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Net2 (affected versions not specified)

Description A potential issue arises when installing the Net2 software, as a root certificate is installed into the trusted store. A hacker could access the installer batch file or reverse engineer the source code to gain access to the root certificate password. Using the root certificate and password, they could create their own certificates to emulate another site. By establishing a proxy service to emulate the site, they could monitor traffic passed between the end user and the site, allowing access to the data content. Approximately 669 systems are potentially affected, mainly distributed in the United Kingdom and the United States.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2023-43870

Affected Products

Net2

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2023-43870 · Security Note
• https://osv.dev/vulnerability/CVE-2023-43870 · Vendor Advisory
• https://t.me/cybersecuritytechnologies/10651 · Telegram Post
• https://t.me/defcon_news/121399 · Telegram Post
• https://paxton-access.com/systems/net2 · Note
• https://t.me/cvenotify/64158 · Telegram Post
• https://t.me/rnetsec/19887 · Telegram Post
• https://twitter.com/ksg93rd/status/1800246113611768075 · Twitter Post
• https://twitter.com/techadversary/status/1753446063103791397 · Twitter Post
• https://t.me/cvenotify/64183 · Telegram Post
• https://twitter.com/zoomeye_team/status/1754817622305288473 · Twitter Post
• https://t.me/secharvester/15238 · Telegram Post
• https://twitter.com/CVEnew/status/1737132702766191050 · Twitter Post