PT-2023-32290 · Microsoft · Windows

Alexander Ratelle · Published 2023-11-06 · Updated 2023-11-14 · CVE-2023-5719

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Crimson 3.2

Description The issue arises when the Windows-based configuration tool is used to define new passwords for users, and these passwords contain the percent (%) character. This can lead to invalid values being included, potentially truncating the string if a NUL is encountered. As a result, if the simplified password is not detected by the administrator, the device might be left in a vulnerable state due to more easily compromised credentials. It's noted that passwords entered via the Crimson system web server do not suffer from this issue.

Recommendations For The Crimson 3.2, avoid using passwords that contain the percent (%) character until a fix is available. As a temporary workaround, consider manually reviewing and verifying all passwords defined through the Windows-based configuration tool to ensure they do not contain the percent character, which could lead to compromised credentials.

Fix

Weakness Enumeration

CWE-158

Related Identifiers

CVE-2023-5719

Affected Products

Windows

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-5719 · Security Note
• https://support.redlion.net/hc/en-us/categories/360002087671-Security-Advisories · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-5719 · Vendor Advisory
• https://cisa.gov/news-events/ics-advisories/icsa-23-306-01 · Note
• https://t.me/cibsecurity/73630 · Telegram Post