PT-2024-12871 · Diebold Nixdorf · Vynamic Security Suite

Published 2024-08-08 · Updated 2024-08-19 · CVE-2023-40261

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Diebold Nixdorf Vynamic Security Suite (VSS) versions prior to 3.3.0 SR17 Diebold Nixdorf Vynamic Security Suite (VSS) versions prior to 4.0.0 SR07 Diebold Nixdorf Vynamic Security Suite (VSS) versions prior to 4.1.0 SR04 Diebold Nixdorf Vynamic Security Suite (VSS) versions prior to 4.2.0 SR04 Diebold Nixdorf Vynamic Security Suite (VSS) versions prior to 4.3.0 SR03

Description The issue is related to the failure of the Vynamic Security Suite to validate file attributes during the Pre-Boot Authorization process. This can be exploited by a physical attacker who can manipulate the system's hard disk contents.

Recommendations For versions prior to 3.3.0 SR17, update to version 3.3.0 SR17 or later. For versions prior to 4.0.0 SR07, update to version 4.0.0 SR07 or later. For versions prior to 4.1.0 SR04, update to version 4.1.0 SR04 or later. For versions prior to 4.2.0 SR04, update to version 4.2.0 SR04 or later. For versions prior to 4.3.0 SR03, update to version 4.3.0 SR03 or later.

Exploit

Fix

Improper Initialization

Weakness Enumeration

CWE-665

Related Identifiers

CVE-2023-40261

Affected Products

Vynamic Security Suite

References · 6

• 🔥 https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Matt%20Burch%20-%20Where%E2%80%99s%20the%20Money%20-%20Defeating%20ATM%20Disk%20Encryption-white%20paper.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2023-40261 · Vendor Advisory
• https://dieboldnixdorf.com/en-us/banking/portfolio/software/security · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40261 · Security Note
• https://t.me/cvenotify/90037 · Telegram Post
• https://t.me/cvedetector/2815 · Telegram Post