PT-2024-15175 · Unknown · Sciener Server

Published 2024-03-15 · Updated 2024-03-17 · CVE-2023-7007

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sciener server (affected versions not specified)

Description The Sciener server does not validate connection requests from the GatewayG2, allowing an impersonation attack. This attack provides the attacker with the unlockKey field.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2023-7007

Affected Products

Sciener Server

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-7007 · Security Note
• https://twitter.com/VulmonFeeds/status/1768706749945553161 · Twitter Post
• https://t.me/cvenotify/74079 · Telegram Post
• https://t.me/cvenotify/73976 · Telegram Post
• https://kb.cert.org/vuls/id/949046 · Note
• https://twitter.com/CVEnew/status/1768690607420027383 · Twitter Post
• https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2 · Note