CVE-2023-0757

{"id": "CVE-2023-0757", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "info@cert.vde.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2023-12-14T14:15:42.083", "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2023-051/", "tags": ["Third Party Advisory"], "source": "info@cert.vde.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "info@cert.vde.com", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "Incorrect Permission Assignment for Critical Resource vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to upload arbitrary malicious code and gain full access on the affected device."}, {"lang": "es", "value": "Asignaci\u00f3n de permisos incorrecta para una vulnerabilidad de recursos cr\u00edticos en PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) permite a un atacante remoto no autenticado cargar c\u00f3digo malicioso arbitrario y obtener acceso completo al dispositivo afectado."}], "lastModified": "2023-12-21T17:13:25.403", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:phoenixcontact:multiprog:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "42452860-CB53-479D-ADE1-E8166EC834C4"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:phoenixcontact:proconos_eclr:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B9A422FD-2C4C-4B77-B619-6747474A3FA7"}], "operator": "OR"}]}], "sourceIdentifier": "info@cert.vde.com"}