PT-2024-12023 · Diebold Nixdorf · Vynamic Security Suite

Published 2024-08-08 · Updated 2024-08-19 · CVE-2023-24064

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Diebold Nixdorf Vynamic Security Suite (VSS) versions prior to 3.3.0 SR4

Description The issue arises from the failure to validate /etc/initab during the Pre-Boot Authorization (PBA) process. This can be exploited by a physical attacker who is able to manipulate the contents of the system's hard disk.

Recommendations For versions prior to 3.3.0 SR4, update to version 3.3.0 SR4 or later to resolve the issue. As a temporary workaround, consider restricting physical access to the system's hard disk to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2023-24064

Affected Products

Vynamic Security Suite

References · 6

• 🔥 https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Matt%20Burch%20-%20Where%E2%80%99s%20the%20Money%20-%20Defeating%20ATM%20Disk%20Encryption-white%20paper.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-24064 · Security Note
• https://dieboldnixdorf.com/en-us/banking/portfolio/software/security · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-24064 · Vendor Advisory
• https://t.me/cvedetector/2818 · Telegram Post
• https://t.me/cvenotify/90036 · Telegram Post