CVE-2023-50706

A user without administrator permissions with access to the UC500 windows system could perform a memory dump of the running processes and extract clear credentials or valid session tokens.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.7 / Impact : 3.6

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-03	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:efacec:uc_500e_firmware:10.1.0:*:*:*:*:*:*:*

cpe:2.3:h:efacec:uc_500e:-:*:*:*:*:*:*:*

History

29 Dec 2023, 16:25

Type	Values Removed	Values Added
CPE		cpe:2.3:o:efacec:uc_500e_firmware:10.1.0:::::::* cpe:2.3:h:efacec:uc_500e:-:::::::*
CVSS	v2 : ~~unknown~~ v3 : ~~4.1~~	v2 : unknown v3 : 4.3
References	~~() https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-03 -~~	() https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-03 - Third Party Advisory, US Government Resource
Summary		(es) Un usuario sin permisos de administrador con acceso al sistema Windows UC500 podría realizar un volcado de memoria de los procesos en ejecución y extraer credenciales claras o tokens de sesión válidos.
First Time		Efacec Efacec uc 500e Firmware Efacec uc 500e
CWE		NVD-CWE-Other

20 Dec 2023, 00:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-12-20 00:15

Updated : 2023-12-29 16:25

NVD link : CVE-2023-50706

Mitre link : CVE-2023-50706

CVE.ORG link : CVE-2023-50706

JSON object : View

Products Affected

efacec

uc_500e_firmware
uc_500e

CWE

NVD-CWE-Other CWE-284

Improper Access Control

{"id": "CVE-2023-50706", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.7}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.1, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 0.7}]}, "published": "2023-12-20T00:15:09.437", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-03", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "\n\n\n\n\n\n\n\n\n\n\n\n\nA user without administrator permissions with access to the UC500 windows system could perform a memory dump of the running processes and extract clear credentials or valid session tokens.\n\n\n\n"}, {"lang": "es", "value": "Un usuario sin permisos de administrador con acceso al sistema Windows UC500 podr\u00eda realizar un volcado de memoria de los procesos en ejecuci\u00f3n y extraer credenciales claras o tokens de sesi\u00f3n v\u00e1lidos."}], "lastModified": "2023-12-29T16:25:56.740", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:efacec:uc_500e_firmware:10.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1DF70D3D-3373-461B-BF6F-BEF45FDE3CA2"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:efacec:uc_500e:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "69426677-21FE-4260-A8AA-1A30707FED0E"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}