CVE-2023-31100 - OpenCVE

Improper Access Control in SMI handler vulnerability in Phoenix SecureCore™ Technology™ 4 allows SPI flash modification. This issue affects SecureCore™ Technology™ 4: * from 4.3.0.0 before 4.3.0.203 * from 4.3.1.0 before 4.3.1.163 * from 4.4.0.0 before 4.4.0.217 * from 4.5.0.0 before 4.5.0.138

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Phoenix	Securecore Technology

Configuration 1 [-]

OR	cpe:2.3:o:phoenix:securecore_technology::::::::
	cpe:2.3:o:phoenix:securecore_technology::::::::
	cpe:2.3:o:phoenix:securecore_technology::::::::
	cpe:2.3:o:phoenix:securecore_technology::::::::

No data.

References

Link	Providers
https://www.phoenix.com/security-notifications/

History

No history.

MITRE

Status: PUBLISHED

Assigner: Phoenix

Published: 2023-11-14T23:17:07.869Z

Updated: 2024-08-02T14:45:25.673Z

Reserved: 2023-04-24T06:17:27.488Z

Link: CVE-2023-31100

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2023-11-15T00:15:07.573

Modified: 2024-02-01T02:30:22.687

Link: CVE-2023-31100

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-31100", "assignerOrgId": "22d9ba52-f336-4b0d-bf1f-0efbdcc3c1de", "state": "PUBLISHED", "assignerShortName": "Phoenix", "dateReserved": "2023-04-24T06:17:27.488Z", "datePublished": "2023-11-14T23:17:07.869Z", "dateUpdated": "2024-08-02T14:45:25.673Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "SecureCore\u2122 Technology\u2122 4", "vendor": "Phoenix", "versions": [{"lessThan": "4.3.0.203", "status": "affected", "version": "4.3.0.0", "versionType": "custom"}, {"lessThan": "4.3.1.163", "status": "affected", "version": "4.3.1.0", "versionType": "custom"}, {"lessThan": "4.4.0.217", "status": "affected", "version": "4.4.0.0", "versionType": "custom"}, {"lessThan": "4.5.0.138", "status": "affected", "version": "4.5.0.0", "versionType": "custom"}]}], "datePublic": "2023-11-14T21:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Access Control in SMI handler vulnerability in Phoenix SecureCore\u2122 Technology\u2122 4 allows SPI flash modification.<br><p>This issue affects SecureCore\u2122 Technology\u2122 4:<br></p><ul><li>from 4.3.0.0 before 4.3.0.203</li><li>\n\nfrom \n\n4.3.1.0 before 4.3.1.163</li><li>\n\nfrom \n\n4.4.0.0 before 4.4.0.217</li><li>\n\nfrom \n\n4.5.0.0 before 4.5.0.138</li></ul><p></p>"}], "value": "Improper Access Control in SMI handler vulnerability in Phoenix SecureCore\u2122 Technology\u2122 4 allows SPI flash modification.\nThis issue affects SecureCore\u2122 Technology\u2122 4:\n\n\n * from 4.3.0.0 before 4.3.0.203\n * \n\nfrom \n\n4.3.1.0 before 4.3.1.163\n * \n\nfrom \n\n4.4.0.0 before 4.4.0.217\n * \n\nfrom \n\n4.5.0.0 before 4.5.0.138\n\n\n\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284 Improper Access Control in SMI handler", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "22d9ba52-f336-4b0d-bf1f-0efbdcc3c1de", "shortName": "Phoenix", "dateUpdated": "2023-11-15T01:07:14.545Z"}, "references": [{"url": "https://www.phoenix.com/security-notifications/"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T14:45:25.673Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.phoenix.com/security-notifications/", "tags": ["x_transferred"]}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenix:securecore_technology:*:*:*:*:*:*:*:*", "matchCriteriaId": "E56DABBE-40F8-4A26-92C6-9506AA426673", "versionEndExcluding": "4.3.0.203", "versionStartIncluding": "4.3.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:phoenix:securecore_technology:*:*:*:*:*:*:*:*", "matchCriteriaId": "D2466200-7229-4412-83BE-E1B0FC076CCD", "versionEndExcluding": "4.3.1.163", "versionStartIncluding": "4.3.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:phoenix:securecore_technology:*:*:*:*:*:*:*:*", "matchCriteriaId": "7AE48D55-B352-497B-9E69-4BE0B0A35865", "versionEndExcluding": "4.4.0.217", "versionStartIncluding": "4.4.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:phoenix:securecore_technology:*:*:*:*:*:*:*:*", "matchCriteriaId": "DA9F0AF7-9C96-4523-B30F-78C2BEEE933C", "versionEndExcluding": "4.5.0.138", "versionStartIncluding": "4.5.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Access Control in SMI handler vulnerability in Phoenix SecureCore\u2122 Technology\u2122 4 allows SPI flash modification.\nThis issue affects SecureCore\u2122 Technology\u2122 4:\n\n\n * from 4.3.0.0 before 4.3.0.203\n * \n\nfrom \n\n4.3.1.0 before 4.3.1.163\n * \n\nfrom \n\n4.4.0.0 before 4.4.0.217\n * \n\nfrom \n\n4.5.0.0 before 4.5.0.138\n\n\n\n\n"}, {"lang": "es", "value": "Control de Acceso Inadecuado en la vulnerabilidad del Control SMI en Phoenix SecureCore\u2122 Technology\u2122 4 permite la modificaci\u00f3n de flash SPI. Este problema afecta a SecureCore\u2122 Technology\u2122 4: * desde 4.3.0.0 anterior a 4.3.0.203 * desde 4.3.1.0 anterior a 4.3.1.163 * desde 4.4.0.0 anterior a 4.4.0.217 * desde 4.5.0.0 anterior a 4.5.0.138"}], "id": "CVE-2023-31100", "lastModified": "2024-02-01T02:30:22.687", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 5.8, "source": "22d9ba52-f336-4b0d-bf1f-0efbdcc3c1de", "type": "Secondary"}]}, "published": "2023-11-15T00:15:07.573", "references": [{"source": "22d9ba52-f336-4b0d-bf1f-0efbdcc3c1de", "tags": ["Vendor Advisory"], "url": "https://www.phoenix.com/security-notifications/"}], "sourceIdentifier": "22d9ba52-f336-4b0d-bf1f-0efbdcc3c1de", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-284"}], "source": "22d9ba52-f336-4b0d-bf1f-0efbdcc3c1de", "type": "Secondary"}]}