fkie_cve-2023-5719
Vulnerability from fkie_nvd
Published
2023-11-06 20:15
Modified
2024-11-21 08:42
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
The Crimson 3.2 Windows-based configuration tool allows users with administrative access to define new passwords for users and to download the resulting security configuration to a device. If such a password contains the percent (%) character, invalid values will be included, potentially truncating the string if a NUL is encountered. If the simplified password is not detected by the administrator, the device might be left in a vulnerable state as a result of more-easily compromised credentials. Note that passwords entered via the Crimson system web server do not suffer from this vulnerability.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| ics-cert@hq.dhs.gov | https://support.redlion.net/hc/en-us/categories/360002087671-Security-Advisories | Vendor Advisory | |
| ics-cert@hq.dhs.gov | https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-01 | Third Party Advisory, US Government Resource | |
| af854a3a-2127-422b-91ae-364da2661108 | https://support.redlion.net/hc/en-us/categories/360002087671-Security-Advisories | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-01 | Third Party Advisory, US Government Resource |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| redlion | crimson | * | |
| redlion | crimson | 3.2 | |
| redlion | crimson | 3.2 | |
| redlion | crimson | 3.2 | |
| redlion | crimson | 3.2 | |
| redlion | crimson | 3.2 | |
| redlion | crimson | 3.2 | |
| redlion | crimson | 3.2 | |
| redlion | crimson | 3.2 | |
| redlion | crimson | 3.2 | |
| redlion | crimson | 3.2 | |
| redlion | crimson | 3.2 | |
| redlion | crimson | 3.2 | |
| redlion | crimson | 3.2 | |
| redlion | crimson | 3.2 | |
| redlion | crimson | 3.2 | |
| redlion | crimson | 3.2 | |
| redlion | crimson | 3.2 | |
| redlion | crimson | 3.2 | |
| redlion | crimson | 3.2 | |
| redlion | crimson | 3.2 | |
| redlion | crimson | 3.2 | |
| redlion | da50a | - | |
| redlion | da70a | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:redlion:crimson:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4295D087-6FAF-4443-AC03-5D2DF83AE38E",
"versionEndExcluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0008.0:*:*:*:*:*:*",
"matchCriteriaId": "2462AB8D-13B5-434F-B53F-AC43952C59D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0014.0:*:*:*:*:*:*",
"matchCriteriaId": "7AEFD4D3-3A5E-4A97-8F8A-00A802EC046E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0015.0:*:*:*:*:*:*",
"matchCriteriaId": "4FC7C595-57E9-46BE-A507-7155310F5BB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0016.0:*:*:*:*:*:*",
"matchCriteriaId": "3EFBC0AE-1BDC-4159-8FA2-4626E1A02F17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0020.0:*:*:*:*:*:*",
"matchCriteriaId": "1F6BEB68-BB83-488F-BAD1-674FDA11B7EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0021.0:*:*:*:*:*:*",
"matchCriteriaId": "8C0B5D43-45BD-4A85-808F-8A0B9818F83A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0025.0:*:*:*:*:*:*",
"matchCriteriaId": "7202BC35-500E-4DD5-BD65-5E5F849AB97D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0026.0:*:*:*:*:*:*",
"matchCriteriaId": "EEE9C0C7-23DC-406E-B89C-CE7C66E4BBEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0030.0:*:*:*:*:*:*",
"matchCriteriaId": "83A2D6CA-1BB5-4096-921B-4A722A97AA7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0031.0:*:*:*:*:*:*",
"matchCriteriaId": "9254CF9B-4421-4808-873E-0D0C568FFC06",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0035.0:*:*:*:*:*:*",
"matchCriteriaId": "5FA689AC-FDFB-493F-86F0-5C8252B1DB2D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0036.0:*:*:*:*:*:*",
"matchCriteriaId": "AB9216B2-FA80-4B8E-B3E7-F1CA85534F2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0040.0:*:*:*:*:*:*",
"matchCriteriaId": "89B84594-35D4-40AA-9E66-53D4F586F3F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0041.0:*:*:*:*:*:*",
"matchCriteriaId": "85C30545-0932-4F9C-984E-FAAA464D3DC6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0044.0:*:*:*:*:*:*",
"matchCriteriaId": "C092F331-B3DD-4CA9-B855-B9D30454842C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0047.0:*:*:*:*:*:*",
"matchCriteriaId": "D95F12E5-B703-4F62-BD8B-43AEB1E1716E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0050.0:*:*:*:*:*:*",
"matchCriteriaId": "E31D51E4-FD61-4583-81A9-7F349523C7AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0051.0:*:*:*:*:*:*",
"matchCriteriaId": "B413CDBE-65DF-4012-A17E-C97A869CD9F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0053.0:*:*:*:*:*:*",
"matchCriteriaId": "B20CE831-D90B-41AB-88F7-6488799EF10D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0053.1:*:*:*:*:*:*",
"matchCriteriaId": "A3BF2AD6-4B14-4A6D-AF6E-EFAF138D52C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0053.18:*:*:*:*:*:*",
"matchCriteriaId": "57F4B49C-2A3B-4240-BF79-F0F91FA12E05",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:redlion:da50a:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F375BCC0-0CC2-4ABE-8C9F-B22727E71A22",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:redlion:da70a:-:*:*:*:*:*:*:*",
"matchCriteriaId": "58648F47-7CB3-4347-B8EF-5D71F1C9F1CF",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "\nThe Crimson 3.2 Windows-based configuration tool allows users with administrative access to define new passwords for users and to download the resulting security configuration to a device. If such a password contains the percent (%) character, invalid values will be included, potentially truncating the string if a NUL is encountered. If the simplified password is not detected by the administrator, the device might be left in a vulnerable state as a result of more-easily compromised credentials. Note that passwords entered via the Crimson system web server do not suffer from this vulnerability.\n\n"
},
{
"lang": "es",
"value": "La herramienta de configuraci\u00f3n Crimson 3.2 basada en Windows permite a los usuarios con acceso administrativo definir nuevas contrase\u00f1as para los usuarios y descargar la configuraci\u00f3n de seguridad resultante a un dispositivo. Si dicha contrase\u00f1a contiene el car\u00e1cter de porcentaje (%), se incluir\u00e1n valores no v\u00e1lidos, lo que podr\u00eda truncar la cadena si se encuentra un NUL. Si el administrador no detecta la contrase\u00f1a simplificada, el dispositivo podr\u00eda quedar en un estado vulnerable como resultado de que las credenciales se vean comprometidas m\u00e1s f\u00e1cilmente. Tenga en cuenta que las contrase\u00f1as ingresadas a trav\u00e9s del servidor web del sistema Crimson no sufren esta vulnerabilidad."
}
],
"id": "CVE-2023-5719",
"lastModified": "2024-11-21T08:42:21.013",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "ics-cert@hq.dhs.gov",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-11-06T20:15:07.950",
"references": [
{
"source": "ics-cert@hq.dhs.gov",
"tags": [
"Vendor Advisory"
],
"url": "https://support.redlion.net/hc/en-us/categories/360002087671-Security-Advisories"
},
{
"source": "ics-cert@hq.dhs.gov",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-01"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://support.redlion.net/hc/en-us/categories/360002087671-Security-Advisories"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-01"
}
],
"sourceIdentifier": "ics-cert@hq.dhs.gov",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-158"
}
],
"source": "ics-cert@hq.dhs.gov",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…