CVE-2023-1516 - Vulnerability Details - OpenCVE

RoboDK versions 5.5.3 and prior contain an insecure permission
assignment to critical directories vulnerability, which could allow a
local user to escalate privileges and write files to the RoboDK process
and achieve code execution.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00035.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Robodk	Robodk

Configuration 1 [-]

cpe:2.3:a:robodk:robodk:*:*:*:*:*:*:*:*

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

RoboDK has not responded to requests to work with CISA to mitigate this vulnerability. Users of the affected product are encouraged to contact RoboDK support for additional information.

References

Link	Providers
https://robodk.com/contact
https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-01

History

Thu, 16 Jan 2025 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2023-03-28T20:34:52.453Z

Updated: 2025-01-16T21:37:33.820Z

Reserved: 2023-03-20T14:20:50.559Z

Link: CVE-2023-1516

Vulnrichment

Updated: 2024-08-02T05:49:11.662Z

NVD

Status : Modified

Published: 2023-03-28T21:15:10.293

Modified: 2024-11-21T07:39:21.057

Link: CVE-2023-1516

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-1516", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2023-03-20T14:20:50.559Z", "datePublished": "2023-03-28T20:34:52.453Z", "dateUpdated": "2025-01-16T21:37:33.820Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "RoboDK ", "vendor": "RoboDK ", "versions": [{"lessThanOrEqual": "5.5.3", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "reporter", "user": "00000000-0000-4000-9000-000000000000", "value": "Noam Moshe of Claroty reported this vulnerability to CISA. "}], "datePublic": "2023-03-23T20:31:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\nRoboDK versions 5.5.3 and prior contain an insecure permission \nassignment to critical directories vulnerability, which could allow a \nlocal user to escalate privileges and write files to the RoboDK process \nand achieve code execution.  \n\n"}], "value": "RoboDK versions 5.5.3 and prior contain an insecure permission \nassignment to critical directories vulnerability, which could allow a \nlocal user to escalate privileges and write files to the RoboDK process \nand achieve code execution. \u00a0\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.9, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-732", "description": "CWE-732 Incorrect Permission Assignment for Critical Resource", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2023-03-28T20:34:52.453Z"}, "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-01"}, {"url": "https://robodk.com/contact"}], "source": {"discovery": "EXTERNAL"}, "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\nRoboDK has not responded to requests to work with CISA to mitigate this \nvulnerability. Users of the affected product are encouraged to contact \nRoboDK support for additional information. \n\n<br>"}], "value": "RoboDK has not responded to requests to work with CISA to mitigate this \nvulnerability. Users of the affected product are encouraged to contact \nRoboDK support for additional information. \n\n\n"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T05:49:11.662Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-01", "tags": ["x_transferred"]}, {"url": "https://robodk.com/contact", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-16T20:21:38.262557Z", "id": "CVE-2023-1516", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-16T21:37:33.820Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-01", "tags": ["x_transferred"]}, {"url": "https://robodk.com/contact", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T05:49:11.662Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-1516", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-16T20:21:38.262557Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-16T20:21:40.086Z"}}], "cna": {"source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "user": "00000000-0000-4000-9000-000000000000", "value": "Noam Moshe of Claroty reported this vulnerability to CISA. "}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.9, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "RoboDK ", "product": "RoboDK ", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "5.5.3"}], "defaultStatus": "unaffected"}], "datePublic": "2023-03-23T20:31:00.000Z", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-01"}, {"url": "https://robodk.com/contact"}], "workarounds": [{"lang": "en", "value": "RoboDK has not responded to requests to work with CISA to mitigate this \nvulnerability. Users of the affected product are encouraged to contact \nRoboDK support for additional information. \n\n\n", "supportingMedia": [{"type": "text/html", "value": "\nRoboDK has not responded to requests to work with CISA to mitigate this \nvulnerability. Users of the affected product are encouraged to contact \nRoboDK support for additional information. \n\n<br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "RoboDK versions 5.5.3 and prior contain an insecure permission \nassignment to critical directories vulnerability, which could allow a \nlocal user to escalate privileges and write files to the RoboDK process \nand achieve code execution. \u00a0\n\n", "supportingMedia": [{"type": "text/html", "value": "\nRoboDK versions 5.5.3 and prior contain an insecure permission \nassignment to critical directories vulnerability, which could allow a \nlocal user to escalate privileges and write files to the RoboDK process \nand achieve code execution.  \n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-732", "description": "CWE-732 Incorrect Permission Assignment for Critical Resource"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2023-03-28T20:34:52.453Z"}}}, "cveMetadata": {"cveId": "CVE-2023-1516", "state": "PUBLISHED", "dateUpdated": "2025-01-16T21:37:33.820Z", "dateReserved": "2023-03-20T14:20:50.559Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2023-03-28T20:34:52.453Z", "assignerShortName": "icscert"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:robodk:robodk:*:*:*:*:*:*:*:*", "matchCriteriaId": "7C7BF6E6-1F9D-458A-AE37-AD3CD68C9C6A", "versionEndIncluding": "5.5.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "RoboDK versions 5.5.3 and prior contain an insecure permission \nassignment to critical directories vulnerability, which could allow a \nlocal user to escalate privileges and write files to the RoboDK process \nand achieve code execution. \u00a0\n\n"}], "id": "CVE-2023-1516", "lastModified": "2024-11-21T07:39:21.057", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.9, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 4.7, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-03-28T21:15:10.293", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Product"], "url": "https://robodk.com/contact"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-01"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://robodk.com/contact"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-01"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-732"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-732"}], "source": "nvd@nist.gov", "type": "Primary"}]}