CVE-2023-50443

Encrypted disks created by PRIMX CRYHOD for Windows before Q.2020.4 (ANSSI qualification submission) or CRYHOD for Windows before 2023.5 can be modified by an unauthenticated attacker to include a UNC reference so that it could trigger outbound network traffic from computers on which disks are opened.

CVSS v3 4.6 MEDIUM

4.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 3.6

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.primx.eu/en/bulletins/security-bulletin-23B3093B/	Vendor Advisory
https://www.primx.eu/fr/blog/	Product

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:primx:cryhod::::::::
	cpe:2.3:a:primx:cryhod::::::::
	cpe:2.3:a:primx:cryhod::::::::

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

History

20 Dec 2023, 18:51

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.6
References	~~() https://www.primx.eu/en/bulletins/security-bulletin-23B3093B/ -~~	() https://www.primx.eu/en/bulletins/security-bulletin-23B3093B/ - Vendor Advisory
References	~~() https://www.primx.eu/fr/blog/ -~~	() https://www.primx.eu/fr/blog/ - Product
Summary		(es) Un atacante no autenticado puede modificar los discos cifrados creados por PRIMX CRYHOD para Windows antes de Q.2020.4 (envío de calificación ANSSI) o CRYHOD para Windows antes de 2023.5 para incluir una referencia UNC que pueda activar el tráfico de red saliente desde las maquinas en las que se abren los discos.
First Time		Primx Primx cryhod Microsoft windows Microsoft
CWE		NVD-CWE-noinfo
CPE		cpe:2.3:a:primx:cryhod:::::::: cpe:2.3:o:microsoft:windows:-:::::::*

13 Dec 2023, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-12-13 21:15

Updated : 2023-12-20 18:51

NVD link : CVE-2023-50443

Mitre link : CVE-2023-50443

CVE.ORG link : CVE-2023-50443

JSON object : View

Products Affected

primx

cryhod

microsoft

windows

CWE

NVD-CWE-noinfo

{"id": "CVE-2023-50443", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.9}]}, "published": "2023-12-13T21:15:09.700", "references": [{"url": "https://www.primx.eu/en/bulletins/security-bulletin-23B3093B/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.primx.eu/fr/blog/", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Encrypted disks created by PRIMX CRYHOD for Windows before Q.2020.4 (ANSSI qualification submission) or CRYHOD for Windows before 2023.5 can be modified by an unauthenticated attacker to include a UNC reference so that it could trigger outbound network traffic from computers on which disks are opened."}, {"lang": "es", "value": "Un atacante no autenticado puede modificar los discos cifrados creados por PRIMX CRYHOD para Windows antes de Q.2020.4 (env\u00edo de calificaci\u00f3n ANSSI) o CRYHOD para Windows antes de 2023.5 para incluir una referencia UNC que pueda activar el tr\u00e1fico de red saliente desde las maquinas en las que se abren los discos."}], "lastModified": "2023-12-20T18:51:56.390", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:primx:cryhod:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9A1BF6FB-C9B9-4110-A216-D3866678E4C6", "versionEndExcluding": "2020.4"}, {"criteria": "cpe:2.3:a:primx:cryhod:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "21524A37-8DC2-45F4-A74B-1FFB90D99F6D", "versionEndExcluding": "2021.3", "versionStartIncluding": "2021.0"}, {"criteria": "cpe:2.3:a:primx:cryhod:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BFBBACA6-D2C0-45CA-BC9E-9CEE0AA2C2C9", "versionEndExcluding": "2023.5", "versionStartIncluding": "2023.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}