// For flags

CVE-2023-45593

 

Severity Score

6.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

A CWE-693 “Protection Mechanism Failure” vulnerability in the embedded Chromium browser (concerning the handling of alternative URLs, other than “ http://localhost” http://localhost” ) allows a physical attacker to read arbitrary files on the file system, alter the configuration of the embedded browser, and have other unspecified impacts to the confidentiality, integrity, and availability of the device. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2.

Una vulnerabilidad CWE-693 de “Fallo del mecanismo de protección” en el navegador Chromium integrado (relacionada con el manejo de URL alternativas, distintas de “http://localhost” http://localhost”) permite a un atacante físico leer archivos arbitrarios en el archivo sistema, alterar la configuración del navegador integrado y tener otros impactos no especificados en la confidencialidad, integridad y disponibilidad del dispositivo. Este problema afecta: Paquete AiLux imx6 inferior a la versión imx6_1.0.7-2.

A CWE-184 “Incomplete List of Disallowed Inputs” vulnerability in the embedded Chromium browser (concerning the handling of alternative URLs, other than “ http://localhost” ) allows a physical attacker to read arbitrary files on the file system, alter the configuration of the embedded browser, and have other unspecified impacts to the confidentiality, integrity, and availability of the device. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2.

*Credits: Andrea Palanca of Nozomi Networks found this bug during a security research activity.
CVSS Scores
Attack Vector
Physical
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2023-10-09 CVE Reserved
  • 2024-03-05 CVE Published
  • 2024-03-06 EPSS Updated
  • 2024-10-17 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-184: Incomplete List of Disallowed Inputs
  • CWE-693: Protection Mechanism Failure
CAPEC
  • CAPEC-150: Collect Data from Common Resource Locations
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
AiLux
Search vendor "AiLux"
 Imx6 Bundle
Search vendor "AiLux" for product "Imx6 Bundle"
 < 1.0.7-2
Search vendor "AiLux" for product "Imx6 Bundle" and version " < 1.0.7-2"
en
Affected