CVE-2023-44120 Vulnerability Details

  /     /     /  

CVE-2023-44120 Metadata Quick Info

CVE Published: 09/01/2024 | CVE Updated: 14/11/2024 | CVE Year: 2023
Source: siemens | Vendor: Siemens | Product: Spectrum Power 7
Status : PUBLISHED

---

CVE-2023-44120 Description

A vulnerability has been identified in Spectrum Power 7 (All versions < V23Q4). The affected product\'s sudo configuration permits the local administrative account to execute several entries as root user. This could allow an authenticated local attacker to inject arbitrary code and gain root access.

Metrics

CVSS Version: 3.1 | Base Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-732
CWE Name: CWE-732: Incorrect Permission Assignment for Critical Resource
Source: Siemens

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).