FKIE_CVE-2023-5719

Vulnerability from fkie_nvd - Published: 2023-11-06 20:15 - Updated: 2024-11-21 08:42
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
The Crimson 3.2 Windows-based configuration tool allows users with administrative access to define new passwords for users and to download the resulting security configuration to a device. If such a password contains the percent (%) character, invalid values will be included, potentially truncating the string if a NUL is encountered. If the simplified password is not detected by the administrator, the device might be left in a vulnerable state as a result of more-easily compromised credentials. Note that passwords entered via the Crimson system web server do not suffer from this vulnerability.
References
ics-cert@hq.dhs.govhttps://support.redlion.net/hc/en-us/categories/360002087671-Security-AdvisoriesVendor Advisory
ics-cert@hq.dhs.govhttps://www.cisa.gov/news-events/ics-advisories/icsa-23-306-01Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108https://support.redlion.net/hc/en-us/categories/360002087671-Security-AdvisoriesVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-01Third Party Advisory, US Government Resource
Impacted products
Vendor Product Version
redlion crimson *
redlion crimson 3.2
redlion crimson 3.2
redlion crimson 3.2
redlion crimson 3.2
redlion crimson 3.2
redlion crimson 3.2
redlion crimson 3.2
redlion crimson 3.2
redlion crimson 3.2
redlion crimson 3.2
redlion crimson 3.2
redlion crimson 3.2
redlion crimson 3.2
redlion crimson 3.2
redlion crimson 3.2
redlion crimson 3.2
redlion crimson 3.2
redlion crimson 3.2
redlion crimson 3.2
redlion crimson 3.2
redlion crimson 3.2
redlion da50a -
redlion da70a -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redlion:crimson:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4295D087-6FAF-4443-AC03-5D2DF83AE38E",
              "versionEndExcluding": "3.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0008.0:*:*:*:*:*:*",
              "matchCriteriaId": "2462AB8D-13B5-434F-B53F-AC43952C59D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0014.0:*:*:*:*:*:*",
              "matchCriteriaId": "7AEFD4D3-3A5E-4A97-8F8A-00A802EC046E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0015.0:*:*:*:*:*:*",
              "matchCriteriaId": "4FC7C595-57E9-46BE-A507-7155310F5BB7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0016.0:*:*:*:*:*:*",
              "matchCriteriaId": "3EFBC0AE-1BDC-4159-8FA2-4626E1A02F17",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0020.0:*:*:*:*:*:*",
              "matchCriteriaId": "1F6BEB68-BB83-488F-BAD1-674FDA11B7EB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0021.0:*:*:*:*:*:*",
              "matchCriteriaId": "8C0B5D43-45BD-4A85-808F-8A0B9818F83A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0025.0:*:*:*:*:*:*",
              "matchCriteriaId": "7202BC35-500E-4DD5-BD65-5E5F849AB97D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0026.0:*:*:*:*:*:*",
              "matchCriteriaId": "EEE9C0C7-23DC-406E-B89C-CE7C66E4BBEB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0030.0:*:*:*:*:*:*",
              "matchCriteriaId": "83A2D6CA-1BB5-4096-921B-4A722A97AA7B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0031.0:*:*:*:*:*:*",
              "matchCriteriaId": "9254CF9B-4421-4808-873E-0D0C568FFC06",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0035.0:*:*:*:*:*:*",
              "matchCriteriaId": "5FA689AC-FDFB-493F-86F0-5C8252B1DB2D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0036.0:*:*:*:*:*:*",
              "matchCriteriaId": "AB9216B2-FA80-4B8E-B3E7-F1CA85534F2B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0040.0:*:*:*:*:*:*",
              "matchCriteriaId": "89B84594-35D4-40AA-9E66-53D4F586F3F6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0041.0:*:*:*:*:*:*",
              "matchCriteriaId": "85C30545-0932-4F9C-984E-FAAA464D3DC6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0044.0:*:*:*:*:*:*",
              "matchCriteriaId": "C092F331-B3DD-4CA9-B855-B9D30454842C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0047.0:*:*:*:*:*:*",
              "matchCriteriaId": "D95F12E5-B703-4F62-BD8B-43AEB1E1716E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0050.0:*:*:*:*:*:*",
              "matchCriteriaId": "E31D51E4-FD61-4583-81A9-7F349523C7AD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0051.0:*:*:*:*:*:*",
              "matchCriteriaId": "B413CDBE-65DF-4012-A17E-C97A869CD9F9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0053.0:*:*:*:*:*:*",
              "matchCriteriaId": "B20CE831-D90B-41AB-88F7-6488799EF10D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0053.1:*:*:*:*:*:*",
              "matchCriteriaId": "A3BF2AD6-4B14-4A6D-AF6E-EFAF138D52C5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redlion:crimson:3.2:build_3.2.0053.18:*:*:*:*:*:*",
              "matchCriteriaId": "57F4B49C-2A3B-4240-BF79-F0F91FA12E05",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:redlion:da50a:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F375BCC0-0CC2-4ABE-8C9F-B22727E71A22",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:redlion:da70a:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "58648F47-7CB3-4347-B8EF-5D71F1C9F1CF",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "\nThe Crimson 3.2 Windows-based configuration tool allows users with administrative access to define new passwords for users and to download the resulting security configuration to a device. If such a password contains the percent (%) character, invalid values will be included, potentially truncating the string if a NUL is encountered. If the simplified password is not detected by the administrator, the device might be left in a vulnerable state as a result of more-easily compromised credentials. Note that passwords entered via the Crimson system web server do not suffer from this vulnerability.\n\n"
    },
    {
      "lang": "es",
      "value": "La herramienta de configuraci\u00f3n Crimson 3.2 basada en Windows permite a los usuarios con acceso administrativo definir nuevas contrase\u00f1as para los usuarios y descargar la configuraci\u00f3n de seguridad resultante a un dispositivo. Si dicha contrase\u00f1a contiene el car\u00e1cter de porcentaje (%), se incluir\u00e1n valores no v\u00e1lidos, lo que podr\u00eda truncar la cadena si se encuentra un NUL. Si el administrador no detecta la contrase\u00f1a simplificada, el dispositivo podr\u00eda quedar en un estado vulnerable como resultado de que las credenciales se vean comprometidas m\u00e1s f\u00e1cilmente. Tenga en cuenta que las contrase\u00f1as ingresadas a trav\u00e9s del servidor web del sistema Crimson no sufren esta vulnerabilidad."
    }
  ],
  "id": "CVE-2023-5719",
  "lastModified": "2024-11-21T08:42:21.013",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "ics-cert@hq.dhs.gov",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-11-06T20:15:07.950",
  "references": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://support.redlion.net/hc/en-us/categories/360002087671-Security-Advisories"
    },
    {
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-01"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://support.redlion.net/hc/en-us/categories/360002087671-Security-Advisories"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-01"
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-158"
        }
      ],
      "source": "ics-cert@hq.dhs.gov",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.