// For flags

CVE-2023-5935

Missing authentication for local web interface in Arc before v1.6.0

Severity Score

7.3
*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

When configuring Arc (e.g. during the first setup), a local web interface is provided to ease the configuration process. Such web interface lacks authentication and may thus be abused by a local attacker or malware running on the machine itself.



A malicious local user or process, during a window of opportunity when the local web interface is active, may be able to extract sensitive information or change Arc's configuration. This could also lead to arbitrary code execution if a malicious update package is installed.

Al configurar Arc (por ejemplo, durante la primera configuración), se proporciona una interfaz web local para facilitar el proceso de configuración. Dicha interfaz web carece de autenticación y, por lo tanto, un atacante local o un malware que se ejecuta en la propia máquina pueden abusar de ella. Un usuario o proceso local malicioso, durante una ventana de oportunidad cuando la interfaz web local está activa, puede extraer información confidencial o cambiar la configuración de Arc. Esto también podría provocar la ejecución de código arbitrario si se instala un paquete de actualización malicioso.

*Credits: This issue was found by Diego Giubertoni of Nozomi Networks Security Research team during an internal penetration testing session.
CVSS Scores
Attack Vector
Local
Attack Complexity
High
Attack Requirements
Present
Privileges Required
None
User Interaction
Passive
System
Vulnerable | Subsequent
Confidentiality
High
None
Integrity
High
None
Availability
High
None
Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2023-11-02 CVE Reserved
  • 2024-05-15 CVE Published
  • 2024-05-16 EPSS Updated
  • 2024-08-02 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-306: Missing Authentication for Critical Function
CAPEC
  • CAPEC-212: Functionality Misuse
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Nozomi Networks
Search vendor "Nozomi Networks"
 Arc
Search vendor "Nozomi Networks" for product "Arc"
 < 1.6.0
Search vendor "Nozomi Networks" for product "Arc" and version " < 1.6.0"
en
Affected