PT-2024-1414 · Check Point+1 · Check Point Iot+2

Published 2024-01-15 · Updated 2024-09-20 · CVE-2023-5253

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nozomi Networks Guardian and CMC (affected versions not specified)

Description A missing authentication check in the WebSocket channel used for the Check Point IoT integration may allow an unauthenticated attacker to obtain assets data without authentication. Malicious unauthenticated users with knowledge of the underlying system may be able to extract limited asset information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2024-00887

CVE-2023-5253

Affected Products

Cmc

Check Point Iot

Nozomi Networks Guardian

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-5253 · Security Note
• https://bdu.fstec.ru/vul/2024-00887 · Security Note
• https://osv.dev/vulnerability/CVE-2023-5253 · Vendor Advisory
• https://security.nozominetworks.com/NN-2023:12-01 · Note
• https://twitter.com/CVEnew/status/1746853262072946932 · Twitter Post
• https://t.me/cvenotify/67460 · Telegram Post
• https://t.me/cvenotify/81156 · Telegram Post
• https://t.me/cvenotify/95403 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1746889446505451655 · Twitter Post