CVE-2023-5500 - OpenCVE

This vulnerability allows an remote attacker with low privileges to misuse Improper Control of Generation of Code ('Code Injection') to gain full control of the affected device.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Frauscher	Frauscher Diagnostic System 102

Configuration 1 [-]

OR	cpe:2.3:a:frauscher:frauscher_diagnostic_system_102::::::fadc::*
	cpe:2.3:a:frauscher:frauscher_diagnostic_system_102::::::fadci::*

No data.

References

Link	Providers
https://cert.vde.com/en/advisories/VDE-2023-049/

History

No history.

MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published: 2023-12-11T07:13:51.308Z

Updated: 2024-08-02T07:59:44.783Z

Reserved: 2023-10-10T13:52:02.969Z

Link: CVE-2023-5500

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2023-12-11T07:15:07.160

Modified: 2023-12-13T21:54:04.667

Link: CVE-2023-5500

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-5500", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "state": "PUBLISHED", "assignerShortName": "CERTVDE", "dateReserved": "2023-10-10T13:52:02.969Z", "datePublished": "2023-12-11T07:13:51.308Z", "dateUpdated": "2024-08-02T07:59:44.783Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "FDS102 for FAdC/FAdCi", "vendor": "Frauscher", "versions": [{"lessThanOrEqual": "2.10.1", "status": "affected", "version": "2.10.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "This vulnerability allows an remote attacker with low privileges to misuse Improper Control of Generation of Code ('Code Injection') to gain full control of the affected device."}], "value": "This vulnerability allows an remote attacker with low privileges to misuse Improper Control of Generation of Code ('Code Injection') to gain full control of the affected device."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2023-12-11T07:13:51.308Z"}, "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2023-049/"}], "source": {"advisory": "VDE-2023-049", "defect": ["CERT@VDE#64600"], "discovery": "UNKNOWN"}, "title": "Frauscher: FDS102 for FAdC/FAdCi remote code execution vulnerability", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:59:44.783Z"}, "title": "CVE Program Container", "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2023-049/", "tags": ["x_transferred"]}]}]}}