PT-2024-12021 · Diebold Nixdorf · Vynamic Security Suite

Published 2024-08-08 · Updated 2024-08-19 · CVE-2023-24062

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Diebold Nixdorf Vynamic Security Suite (VSS) versions prior to 3.3.0 SR12 Diebold Nixdorf Vynamic Security Suite (VSS) versions prior to 4.0.0 SR04 Diebold Nixdorf Vynamic Security Suite (VSS) versions prior to 4.1.0 SR02 Diebold Nixdorf Vynamic Security Suite (VSS) versions prior to 4.2.0 SR01

Description The issue arises from a failure to validate the directory structure of the root file system during the Pre-Boot Authorization (PBA) process. This can be exploited by a physical attacker who manipulates the system's hard disk contents.

Recommendations For versions prior to 3.3.0 SR12, update to version 3.3.0 SR12 or later. For versions prior to 4.0.0 SR04, update to version 4.0.0 SR04 or later. For versions prior to 4.1.0 SR02, update to version 4.1.0 SR02 or later. For versions prior to 4.2.0 SR01, update to version 4.2.0 SR01 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2023-24062

Affected Products

Vynamic Security Suite

References · 5

• 🔥 https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Matt%20Burch%20-%20Where%E2%80%99s%20the%20Money%20-%20Defeating%20ATM%20Disk%20Encryption-white%20paper.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2023-24062 · Vendor Advisory
• https://dieboldnixdorf.com/en-us/banking/portfolio/software/security · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-24062 · Security Note
• https://t.me/cvedetector/2820 · Telegram Post