CVE-2023-5253

medium

Description

A missing authentication check in the WebSocket channel used for the Check Point IoT integration in Nozomi Networks Guardian and CMC, may allow an unauthenticated attacker to obtain assets data without authentication. Malicious unauthenticated users with knowledge on the underlying system may be able to extract limited asset information.

References

https://github.com/nitishsancs/SecureScope

https://github.com/nitishsjsucs/SecureScope

https://github.com/lightman-gg/opencve

https://security.nozominetworks.com/NN-2023:12-01

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-57578

Details

Source: Mitre, NVD

Published: 2024-01-15

Updated: 2024-09-20

Risk Information

CVSS v2

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

Severity: High

CVSS v3

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Severity: High

CVSS v4

Base Score: 6.3

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.00451