On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send broadcast events to any user via the WebMonitor.An unauthenticated user can use this vulnerability to forcefully log out of any currently logged-in user by sending a "password change event". Furthermore, an attacker could use this vulnerability to spam the logged-in user with false events.
References
| Link | Resource |
|---|---|
| https://www.trellix.com/en-us/about/newsroom/stories/research/industrial-and-manufacturing-cves.html | Third Party Advisory |
| https://www.trellix.com/en-us/about/newsroom/stories/research/industrial-and-manufacturing-cves.html | Third Party Advisory |
Configurations
History
21 Nov 2024, 07:58
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.trellix.com/en-us/about/newsroom/stories/research/industrial-and-manufacturing-cves.html - Third Party Advisory |
16 Jun 2023, 18:06
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:trianglemicroworks:scada_data_gateway:*:*:*:*:*:*:*:* | |
| CWE | NVD-CWE-noinfo | |
| First Time |
Trianglemicroworks scada Data Gateway
Trianglemicroworks |
|
| References | (MISC) https://www.trellix.com/en-us/about/newsroom/stories/research/industrial-and-manufacturing-cves.html - Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
07 Jun 2023, 12:52
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-07 07:15
Updated : 2024-11-21 07:58
NVD link : CVE-2023-2187
Mitre link : CVE-2023-2187
CVE.ORG link : CVE-2023-2187
JSON object : View
Products Affected
trianglemicroworks
- scada_data_gateway
CWE