CVE-2023-34441

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 4.7

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a cleartext transmission vulnerability which could allow an attacker to steal the authentication secret from communication traffic to the device and reuse it for arbitrary requests.

References

Link	Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-05	Third Party Advisory US Government Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-05	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:bakerhughes:bentley_nevada_3500_system_firmware:5.0.5:*:*:*:*:*:*:*

cpe:2.3:h:bakerhughes:bentley_nevada_3500_system:-:*:*:*:*:*:*:*

History

21 Nov 2024, 08:07

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~8.2~~	v2 : unknown v3 : 6.8
References	~~() https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-05 - Third Party Advisory, US Government Resource~~	() https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-05 - Third Party Advisory, US Government Resource

Information

Published : 2023-10-19 00:15

Updated : 2024-11-21 08:07

NVD link : CVE-2023-34441

Mitre link : CVE-2023-34441

CVE.ORG link : CVE-2023-34441

JSON object : View

Products Affected

bakerhughes

CWE

CWE-319

Cleartext Transmission of Sensitive Information

{"id": "CVE-2023-34441", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 3.9}]}, "published": "2023-10-19T00:15:16.130", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-05", "tags": ["Third Party Advisory", "US Government Resource"], "source": "[email protected]"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-05", "tags": ["Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-319"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-319"}]}], "descriptions": [{"lang": "en", "value": "\n\n\nBaker Hughes \u2013 Bently Nevada 3500 System TDI Firmware version 5.05\n\n contains\u00a0a cleartext transmission vulnerability which could allow an attacker to \n\nsteal the authentication secret from communication traffic to the device and reuse it for arbitrary requests.\n\n"}, {"lang": "es", "value": "Baker Hughes en Bently Nevada 3500 System TDI Firmware versi\u00f3n 5.05 contiene una vulnerabilidad de transmisi\u00f3n de texto plano que podr\u00eda permitir a un atacante robar el secreto de autenticaci\u00f3n del tr\u00e1fico de comunicaci\u00f3n al dispositivo y reutilizarlo para solicitudes arbitrarias."}], "lastModified": "2024-11-21T08:07:14.900", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:bakerhughes:bentley_nevada_3500_system_firmware:5.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9329A00C-D768-442F-9CDE-0027886D9F3E"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:bakerhughes:bentley_nevada_3500_system:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "CDE17D85-8ABE-45B6-9FFB-66B74CCFF1CD"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "[email protected]"}