CVE-2023-29155

Versions of INEA ME RTU firmware 3.36b and prior do not require authentication to the "root" account on the host system of the device. This could allow an attacker to obtain admin-level access to the host system.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-02	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:inea:me_rtu_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:inea:me_rtu:-:*:*:*:*:*:*:*

History

29 Nov 2023, 20:52

Type	Values Removed	Values Added
CPE		cpe:2.3:o:inea:me_rtu_firmware:::::::: cpe:2.3:h:inea:me_rtu:-:::::::*
References	~~() https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-02 -~~	() https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-02 - Third Party Advisory, US Government Resource
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.8
First Time		Inea me Rtu Inea Inea me Rtu Firmware
CWE		CWE-287

20 Nov 2023, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-11-20 17:15

Updated : 2024-02-28 20:54

NVD link : CVE-2023-29155

Mitre link : CVE-2023-29155

CVE.ORG link : CVE-2023-29155

JSON object : View

Products Affected

inea

me_rtu_firmware
me_rtu

CWE

CWE-287

Improper Authentication

{"id": "CVE-2023-29155", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2023-11-20T17:15:13.143", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-02", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "\nVersions of INEA ME RTU firmware 3.36b and prior do not require authentication to the \"root\" account on the host system of the device. This could allow an attacker to obtain admin-level access to the host system.\n\n\n\n\n"}, {"lang": "es", "value": "Las versiones del firmware INEA ME RTU 3.36b y anteriores no requieren autenticaci\u00f3n en la cuenta \"ra\u00edz\" en el sistema host del dispositivo. Esto podr\u00eda permitir a un atacante obtener acceso de nivel de administrador al sistema host."}], "lastModified": "2023-11-29T20:52:57.780", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:inea:me_rtu_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0B126A5A-58B5-47F5-BE20-33ACBEDBF3B8", "versionEndExcluding": "3.37"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:inea:me_rtu:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "97E14440-C423-4D41-9834-E33564A4B70D"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}