CVE-2023-5253
Check Point IoT integration: WebSocket returns assets data without authentication in Guardian/CMC before 23.3.0
Severity Score
6.3
*CVSS v4
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
A missing authentication check in the WebSocket channel used for the Check Point IoT integration in Nozomi Networks Guardian and CMC, may allow an unauthenticated attacker to obtain assets data without authentication.
Malicious unauthenticated users with knowledge on the underlying system may be able to extract asset information.
Una verificación de autenticación faltante en el canal WebSocket utilizado para la integración de Check Point IoT en Nozomi Networks Guardian y CMC puede permitir que un atacante no autenticado obtenga datos de activos sin autenticación. Los usuarios maliciosos no autenticados con conocimiento sobre el sistema subyacente pueden extraer información de activos.
*Credits:
This issue was found by Nozomi Networks Product Security team during an internal VAPT testing session.
CVSS Scores
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
System
Vulnerable | Subsequent
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2023-09-28 CVE Reserved
- 2024-01-15 CVE Published
- 2024-01-23 EPSS Updated
- 2024-08-02 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-306: Missing Authentication for Critical Function
CAPEC
- CAPEC-115: Authentication Bypass
References (1)
URL | Tag | Source |
---|---|---|
https://security.nozominetworks.com/NN-2023:12-01 | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Nozominetworks Search vendor "Nozominetworks" | Cmc Search vendor "Nozominetworks" for product "Cmc" | < 23.3.0 Search vendor "Nozominetworks" for product "Cmc" and version " < 23.3.0" | - |
Affected
| ||||||
Nozominetworks Search vendor "Nozominetworks" | Guardian Search vendor "Nozominetworks" for product "Guardian" | < 23.3.0 Search vendor "Nozominetworks" for product "Guardian" and version " < 23.3.0" | - |
Affected
|