Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-30558 State: PUBLISHED Published: 2023-04-18T22:35:41.962Z Last Updated: 2025-02-06T17:14:35.050Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: hhyo Products: Archery Problem Types: CWE-89 Description: Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. User input coming from the `db_name` in the `sql/data_dictionary.py` `table_list` endpoint is passed to the methods that follow in a given SQL engine implementations, which concatenate user input unsafely into a SQL query and afterwards pass it to the `query` method of
implementations, which concatenate user input unsafely into a SQL query and afterwards pass it to the `query` method of each database engine for execution. The affected methods are `get_group_tables_by_db` in `sql/engines/mssql.py`which passes unsafe user input to `sql/engines/mssql.py`, and `get_group_tables_by_db` in `sql/engines/oracle.py`which concatenates input which is passed to execution on the database in the `sql/engines/oracle.py` `query` method. Each of these issues may be mitigated by escaping user input or by using prepared statements when executing SQL queries. This issue is also indexed as `GHSL-2022-105`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrich
s. This issue is also indexed as `GHSL-2022-105`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hhyo/Archery/security/advisories/GHSA-jwjj-jgfv-x66q
CVE ID: CVE-2023-30559 State: PUBLISHED Published: 2023-07-13T17:50:13.176Z Last Updated: 2024-08-02T14:28:51.809Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) Vendors: Becton Dickinson & Co Products: BD Alaris™ Point-of-Care Unit (PCU) Model 8015 Problem Types: CWE-20, CWE-345 Description: The firmware update package for the wireless card is not properly signed and can be modified. Additional Analyst Notes: - CVE Program Container: References: - https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-alaris-system-with-guardrails-suite-mx
CVE ID: CVE-2023-30560 State: PUBLISHED Published: 2023-07-13T18:53:49.951Z Last Updated: 2024-10-31T17:33:02.007Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Becton Dickinson & Co Products: BD Alarisâ„¢ Point-of-Care Unit (PCU) Model 8015 Problem Types: CWE-287 Description: The configuration from the PCU can be modified without authentication using physical connection to the PCU. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-alaris-system-with-guardrails-suite-mx
CVE ID: CVE-2023-30561 State: PUBLISHED Published: 2023-07-13T19:03:17.356Z Last Updated: 2024-10-22T16:07:16.822Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) Vendors: Becton Dickinson & Co Products: BD Alarisâ„¢ Point-of-Care Unit (PCU) Model 8015 Problem Types: CWE-311 Description: The data flowing between the PCU and its modules is insecure. A threat actor with physical access could potentially read or modify data by attaching a specially crafted device while an infusion is running. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-alaris-system-with-guardrails-
P Vulnrichment: References: - https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-alaris-system-with-guardrails-suite-mx
CVE ID: CVE-2023-30562 State: PUBLISHED Published: 2023-07-13T19:03:32.964Z Last Updated: 2024-10-22T16:07:32.582Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H) Vendors: Becton Dickinson & Co Products: BD Alarisâ„¢ Guardrailsâ„¢ Editor Problem Types: CWE-345 Description: A GRE dataset file within Systems Manager can be tampered with and distributed to PCUs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-alaris-system-with-guardrails-suite-mx
CVE ID: CVE-2023-30563 State: PUBLISHED Published: 2023-07-13T19:04:43.518Z Last Updated: 2024-10-22T15:48:57.063Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: Becton Dickinson & Co Products: BD Alarisâ„¢ Systems Manager Problem Types: CWE-79 Description: A malicious file could be uploaded into a System Manager User Import Function resulting in a hijacked session. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-alaris-system-with-guardrails-suite-mx
CVE ID: CVE-2023-30564 State: PUBLISHED Published: 2023-07-13T19:06:02.948Z Last Updated: 2024-10-22T15:48:40.865Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: Becton Dickinson & Co Products: BD Alarisâ„¢ Systems Manager Problem Types: CWE-79 Description: Alaris Systems Manager does not perform input validation during the Device Import Function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-alaris-system-with-guardrails-suite-mx
CVE ID: CVE-2023-30565 State: PUBLISHED Published: 2023-07-13T19:06:18.280Z Last Updated: 2024-10-22T15:36:36.823Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Becton Dickinson & Co Products: CQI Reporter Problem Types: CWE-924, CWE-319 Description: An insecure connection between Systems Manager and CQI Reporter application could expose infusion data to an attacker. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-alaris-system-with-guardrails-suite-mx
CVE ID: CVE-2023-30570 State: PUBLISHED Published: 2023-05-28T00:00:00 Last Updated: 2025-01-14T18:14:42.811Z Vendors: n/a Products: n/a Problem Types: n/a Description: pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthenticated IKEv1 Aggressive Mode packets. The earliest affected version is 3.28. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://libreswan.org/security/CVE-2023-30570/CVE-2023-30570.txt
CVE ID: CVE-2023-30571 State: PUBLISHED Published: 2023-05-29T00:00:00 Last Updated: 2025-01-14T17:07:29.493Z Severity: LOW (CVSS 3.9 CVSS:3.1/AC:H/AV:L/A:N/C:L/I:L/PR:L/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and ren
eation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://groups.google.com/g/libarchive-announce - https://github.com/libarchive/libarchive/issues/1876
CVE ID: CVE-2023-30575 State: PUBLISHED Published: 2023-06-07T08:06:36.061Z Last Updated: 2024-10-10T14:39:33.936Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Apache Software Foundation Products: Apache Guacamole Problem Types: CWE-131 Description: Apache Guacamole 1.5.1 and older may incorrectly calculate the lengths of instruction elements sent during the Guacamole protocol handshake, potentially allowing an attacker to inject Guacamole instructions during the handshake through specially-crafted data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/tn63n2lon0h5p45oft834t1dqvvxown
rogram Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/tn63n2lon0h5p45oft834t1dqvvxownv
CVE ID: CVE-2023-30576 State: PUBLISHED Published: 2023-06-07T08:06:54.840Z Last Updated: 2024-10-10T14:43:27.765Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Apache Software Foundation Products: Apache Guacamole Problem Types: CWE-416 Description: Apache Guacamole 0.9.10 through 1.5.1 may continue to reference a freed RDP audio input buffer. Depending on timing, this may allow an attacker to execute arbitrary code with the privileges of the guacd process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/vgtvxb3w7mm84hx6v8dfc0onsoz05gb6
CVE ID: CVE-2023-30577 State: PUBLISHED Published: 2023-07-26T00:00:00.000Z Last Updated: 2025-11-04T16:10:08.775Z Vendors: n/a Products: n/a Problem Types: n/a Description: AMANDA (Advanced Maryland Automatic Network Disk Archiver) before tag-community-3.5.4 mishandles argument checking for runtar.c, a different vulnerability than CVE-2022-37705. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zmanda/amanda/releases/tag/tag-community-3.5.4 - https://github.com/zmanda/amanda/security/advisories/GHSA-crrw-v393-h5q3 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YYGJJARVLRBMNWSNXKZB
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YYGJJARVLRBMNWSNXKZBXZNX3M53OVPA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7OITHG7FBD7HQRX2XT75GSGWB3D6XSZU/ - https://lists.debian.org/debian-lts-announce/2023/12/msg00003.html
CVE ID: CVE-2023-30581 State: PUBLISHED Published: 2023-11-22T23:28:30.768Z Last Updated: 2025-11-03T21:48:01.028Z Vendors: NodeJS Products: Node Description: The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nodejs.org/en/blog/vulnerability/june-2023-security-releases
CVE ID: CVE-2023-30582 State: PUBLISHED Published: 2024-09-07T16:00:35.978Z Last Updated: 2025-04-30T22:24:50.761Z Vendors: NodeJS Products: Node Description: A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument. This flaw arises from an inadequate permission model that fails to restrict file watching through the fs.watchFile API. As a result, malicious actors can monitor files that they do not have explicit read access to. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. Additional Analyst Notes: - CISA ADP Vulnri
CVE was issued, the permission model is an experimental feature of Node.js. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://nodejs.org/en/blog/vulnerability/june-2023-security-releases
CVE ID: CVE-2023-30583 State: PUBLISHED Published: 2024-09-07T16:00:35.918Z Last Updated: 2025-04-30T22:24:51.642Z Vendors: NodeJS Products: Node Description: fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the `--allow-fs-read` flag in Node.js 20. This flaw arises from a missing check in the `fs.openAsBlob()` API. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://nodejs.org/en/blog/vulnerability/june-2023-security-releases
CVE ID: CVE-2023-30584 State: PUBLISHED Published: 2024-09-07T16:00:35.915Z Last Updated: 2025-04-30T22:24:52.470Z Vendors: NodeJS Products: Node Description: A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://nodejs.org/en/blog/vulnerability/june-2023-security-releases
CVE ID: CVE-2023-30585 State: PUBLISHED Published: 2023-11-28T01:23:08.734Z Last Updated: 2025-11-03T21:48:03.373Z Vendors: NodeJS Products: Node Description: A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install Node.js using the .msi installer. This vulnerability emerges during the repair operation, where the "msiexec.exe" process, running under the NT AUTHORITY\SYSTEM context, attempts to read the %USERPROFILE% environment variable from the current user's registry. The issue arises when the path referenced by the %USERPROFILE% environment variable does not exist. In such cases, the "msiexec.exe" process att
e path referenced by the %USERPROFILE% environment variable does not exist. In such cases, the "msiexec.exe" process attempts to create the specified path in an unsafe manner, potentially leading to the creation of arbitrary folders in arbitrary locations. The severity of this vulnerability is heightened by the fact that the %USERPROFILE% environment variable in the Windows registry can be modified by standard (or "non-privileged") users. Consequently, unprivileged actors, including malicious entities or trojans, can manipulate the environment variable key to deceive the privileged "msiexec.exe" process. This manipulation can result in the creation of folders in unintended and potentially ma
ivileged "msiexec.exe" process. This manipulation can result in the creation of folders in unintended and potentially malicious locations. It is important to note that this vulnerability is specific to Windows users who install Node.js using the .msi installer. Users who opt for other installation methods are not affected by this particular issue. Additional Analyst Notes: - CVE Program Container: References: - https://nodejs.org/en/blog/vulnerability/june-2023-security-releases
CVE ID: CVE-2023-30586 State: PUBLISHED Published: 2023-06-30T23:40:08.238Z Last Updated: 2025-05-08T16:14:11.957Z Vendors: NodeJS Products: Node Description: A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model. The attack complexity is high. However, the crypto.setEngine() API can be used to bypass the permission model when called with a compatible OpenSSL engine. The OpenSSL engine can, for example, disable the permission model in the host process by manipulating the process's stack memory to locate the permission model Permission::ena
sion model in the host process by manipulating the process's stack memory to locate the permission model Permission::enabled_ in the host process's heap memory. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1954535 - https://security.netapp.com/advisory/ntap-20230803-0008/
CVE ID: CVE-2023-30587 State: PUBLISHED Published: 2024-09-07T16:00:35.920Z Last Updated: 2025-04-30T22:24:55.029Z Vendors: NodeJS Products: Node Description: A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module (node:inspector). By exploiting the Worker class's ability to create an "internal worker" with the kIsInternal Symbol, attackers can modify the isInternal value when an inspector is attached within the Worker constructor before initializing a new WorkerImpl. This vulnerability exclusively affects Node.js users employing the permission model mechanism. Please note that at the time this CVE
bility exclusively affects Node.js users employing the permission model mechanism. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://nodejs.org/en/blog/vulnerability/june-2023-security-releases
CVE ID: CVE-2023-30588 State: PUBLISHED Published: 2023-11-28T19:15:19.430Z Last Updated: 2025-11-03T21:48:04.920Z Vendors: NodeJS Products: Node Description: When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20. Additional Analyst Notes: - CVE Program C
io. This vulnerability affects all active Node.js versions v16, v18, and, v20. Additional Analyst Notes: - CVE Program Container: References: - https://nodejs.org/en/blog/vulnerability/june-2023-security-releases - https://security.netapp.com/advisory/ntap-20240621-0006/
CVE ID: CVE-2023-30589 State: PUBLISHED Published: 2023-06-30T23:39:59.161Z Last Updated: 2025-11-04T16:10:09.729Z Vendors: NodeJS Products: Node Description: The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20 Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/2001873 - https://lists.fedoraproj
l Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/2001873 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VEEQIN5242K5NBE2CZ4DYTNA5B4YTYE5/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UEJWL67XR67JAGEL2ZK22NA3BRKNMZNY/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKFMKD4MJZIKFQJAAJ4VZ2FHIJ764A76/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HMEELCREWMRT6NS7HWXLA6XFLLMO36HE/ - https://security.netapp.com/advisory/ntap-20230803-0009/ - https://lists.fedorap
age/HMEELCREWMRT6NS7HWXLA6XFLLMO36HE/ - https://security.netapp.com/advisory/ntap-20230803-0009/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VCVG4TQRGTK4LKAZKVEQAUEJM7DUACYE/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IV326O2X4BE3SINX5FJHMAKVHUAA4ZYF/ - https://security.netapp.com/advisory/ntap-20240621-0006/
CVE ID: CVE-2023-30590 State: PUBLISHED Published: 2023-11-28T19:15:19.447Z Last Updated: 2025-11-04T16:10:10.679Z Vendors: NodeJS Products: Node Description: The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: "Generates private and public Diffie-Hellman key values". The documented behavior is very different from the actual behavior, and this difference could easily lead to security issues in applications that us
ery different from the actual behavior, and this difference could easily lead to security issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-level security, implications are consequently broad. Additional Analyst Notes: - CVE Program Container: References: - https://nodejs.org/en/blog/vulnerability/june-2023-security-releases - https://lists.debian.org/debian-lts-announce/2024/03/msg00029.html
CVE ID: CVE-2023-30591 State: PUBLISHED Published: 2023-09-29T05:06:43.923Z Last Updated: 2024-09-23T17:39:24.175Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: NodeBB, Inc. Products: NodeBB Problem Types: CWE-241 Description: Denial-of-service in NodeBB <= v2.8.10 allows unauthenticated attackers to trigger a crash, when invoking `eventName.startsWith()` or `eventName.toString()`, while processing Socket.IO messages via crafted Socket.IO messages containing array or object type for the event name respectively. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://starlabs.sg/advisories/23/23-30591/ - https://githu
VE Program Container: - CISA ADP Vulnrichment: References: - https://starlabs.sg/advisories/23/23-30591/ - https://github.com/NodeBB/NodeBB/commit/37b48b82a4bc7680c6e4c42647209010cb239c2c - https://github.com/NodeBB/NodeBB/commit/830f142b7aea2e597294a84d52c05aab3a3539ca - https://github.com/NodeBB/NodeBB/commit/4d2d76897a02e7068ab74c81d17a2febfae8bfb9
CVE ID: CVE-2023-30601 State: PUBLISHED Published: 2023-05-30T07:25:49.920Z Last Updated: 2024-10-09T20:55:28.951Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Apache Software Foundation Products: Apache Cassandra Problem Types: CWE-269 Description: Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache Cassandra This issue affects Apache Cassandra: from 4.0.0 through 4.0.9, from 4.1.0 through 4.1.1. WORKAROUND The vulnerability requires nodetool/JMX access to be exploitable, disable access for any non-trusted users. MITIGATION Upgrade to 4.0.10 or 4.1.2 and leave the new FQL/Auditl
xploitable, disable access for any non-trusted users. MITIGATION Upgrade to 4.0.10 or 4.1.2 and leave the new FQL/Auditlog configuration property allow_nodetool_archive_command as false. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/f74p9jdhmmp7vtrqd8lgm8bq3dhxl8vn
CVE ID: CVE-2023-30602 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-08T18:12:52.770Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Hitron Technologies Inc. Products: Hitron CODA-5310 Problem Types: CWE-319 Description: Hitron Technologies CODA-5310’s Telnet function transfers sensitive data in plaintext. An unauthenticated remote attacker can exploit this vulnerability to access credentials of normal users and administrator. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7084-74e83-1.html
CVE ID: CVE-2023-30603 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-08T20:00:45.438Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hitron Technologies Inc. Products: Hitron CODA-5310 Problem Types: CWE-1392 Description: Hitron Technologies CODA-5310 Telnet function with the default account and password, and there is no warning or prompt to ask users to change the default password and account. An unauthenticated remote attackers can exploit this vulnerability to obtain the administrator’s privilege, resulting in performing arbitrary system operation or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP