CVE-2023-39172 - Vulnerability Details - OpenCVE

The affected devices transmit sensitive information unencrypted allowing a remote unauthenticated attacker to capture and modify network traffic.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00193.

Key SSVC decision points have not yet been added.

Vendors	Products
Enbw	Senec Storage Box Senec Storage Box Firmware

Configuration 1 [-]

AND

cpe:2.3:o:enbw:senec_storage_box_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:enbw:senec_storage_box:v1:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:enbw:senec_storage_box_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:enbw:senec_storage_box:v2:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:enbw:senec_storage_box_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:enbw:senec_storage_box:v3:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2023-42907	The affected devices transmit sensitive information unencrypted allowing a remote unauthenticated attacker to capture and modify network traffic.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://seclists.org/fulldisclosure/2023/Nov/4

History

No history.

MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published: 2023-12-07T13:58:56.198Z

Updated: 2024-08-02T18:02:06.458Z

Reserved: 2023-07-25T14:06:01.345Z

Link: CVE-2023-39172

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-12-07T14:15:07.883

Modified: 2024-11-21T08:14:50.917

Link: CVE-2023-39172

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-39172", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "state": "PUBLISHED", "assignerShortName": "CERTVDE", "dateReserved": "2023-07-25T14:06:01.345Z", "datePublished": "2023-12-07T13:58:56.198Z", "dateUpdated": "2024-08-02T18:02:06.458Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Storage Box V1", "vendor": "SENEC", "versions": [{"status": "affected", "version": "V1"}]}, {"defaultStatus": "unaffected", "product": "Storage Box V2", "vendor": "SENEC", "versions": [{"status": "affected", "version": "V2"}]}, {"defaultStatus": "unaffected", "product": "Storage Box V3", "vendor": "SENEC", "versions": [{"status": "affected", "version": "V3"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Ph0s[4]"}, {"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "R0ckE7"}], "datePublic": "2023-12-07T14:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The affected devices transmit sensitive information unencrypted allowing a remote unauthenticated attacker to capture and modify network traffic."}], "value": "The affected devices transmit sensitive information unencrypted allowing a remote unauthenticated attacker to capture and modify network traffic."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-319", "description": "CWE-319 Cleartext Transmission of Sensitive Information", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2023-12-07T14:00:24.457Z"}, "references": [{"url": "https://seclists.org/fulldisclosure/2023/Nov/4"}], "source": {"defect": ["CERT@VDE#64567"], "discovery": "UNKNOWN"}, "title": "SENEC: Storage Box V1,V2 and V3 transmitting sensitive data unencrypted", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:02:06.458Z"}, "title": "CVE Program Container", "references": [{"url": "https://seclists.org/fulldisclosure/2023/Nov/4", "tags": ["x_transferred"]}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:enbw:senec_storage_box_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "AF2C3F5B-266D-455B-944D-9EDBB0268439", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:enbw:senec_storage_box:v1:*:*:*:*:*:*:*", "matchCriteriaId": "1A73E447-D78F-420B-B256-1F157A6DA364", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:enbw:senec_storage_box_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "AF2C3F5B-266D-455B-944D-9EDBB0268439", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:enbw:senec_storage_box:v2:*:*:*:*:*:*:*", "matchCriteriaId": "300B219B-45CA-44C0-AC39-D94057FA8860", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:enbw:senec_storage_box_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "AF2C3F5B-266D-455B-944D-9EDBB0268439", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:enbw:senec_storage_box:v3:*:*:*:*:*:*:*", "matchCriteriaId": "449C542C-CAE3-42A9-BF45-EE6E828A4EBE", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "The affected devices transmit sensitive information unencrypted allowing a remote unauthenticated attacker to capture and modify network traffic."}, {"lang": "es", "value": "Los dispositivos afectados transmiten informaci\u00f3n confidencial sin cifrar, lo que permite a un atacante remoto no autenticado capturar y modificar el tr\u00e1fico de la red."}], "id": "CVE-2023-39172", "lastModified": "2024-11-21T08:14:50.917", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "info@cert.vde.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-12-07T14:15:07.883", "references": [{"source": "info@cert.vde.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://seclists.org/fulldisclosure/2023/Nov/4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://seclists.org/fulldisclosure/2023/Nov/4"}], "sourceIdentifier": "info@cert.vde.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-319"}], "source": "info@cert.vde.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-319"}], "source": "nvd@nist.gov", "type": "Primary"}]}