CVE-2023-2024

CRITICAL

10.0

Descricao

Improper authentication in OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 allow access to an unauthorized user under certain circumstances.

Detalhes CVE

Pontuacao CVSS v3.110.0

SeveridadeCRITICAL

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado5/18/2023

Ultima modificacao11/21/2024

Fontenvd

Avistamentos honeypot0

Produtos afetados

johnsoncontrols:openblue_enterprise_manager_data_collector

Fraquezas (CWE)

CWE-287CWE-287

Referencias

https://www.cisa.gov/news-events/ics-advisories/icsa-23-138-04(productsecurity@jci.com)

https://www.johnsoncontrols.com/cyber-solutions/security-advisories(productsecurity@jci.com)

https://www.cisa.gov/news-events/ics-advisories/icsa-23-138-04(af854a3a-2127-422b-91ae-364da2661108)

https://www.johnsoncontrols.com/cyber-solutions/security-advisories(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.