CVE-2023-40708

The File Transfer Protocol (FTP) port is open by default in the SNAP PAC S1 Firmware version R10.3b. This could allow an adversary to access some device files.

CVSS v3 5.8 MEDIUM

5.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-02	Third Party Advisory US Government Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-02	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:opto22:snap_pac_s1_firmware:r10.3b:*:*:*:*:*:*:*

cpe:2.3:h:opto22:snap_pac_s1:-:*:*:*:*:*:*:*

History

21 Nov 2024, 08:20

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~5.3~~	v2 : unknown v3 : 5.8
References	~~() https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-02 - Third Party Advisory, US Government Resource~~	() https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-02 - Third Party Advisory, US Government Resource

11 Sep 2024, 16:15

Type	Values Removed	Values Added
CWE	~~CWE-284~~	CWE-1188

Information

Published : 2023-08-24 17:15

Updated : 2024-11-21 08:20

NVD link : CVE-2023-40708

Mitre link : CVE-2023-40708

CVE.ORG link : CVE-2023-40708

JSON object : View

Products Affected

opto22

snap_pac_s1_firmware
snap_pac_s1

CWE

CWE-1188

Initialization of a Resource with an Insecure Default

NVD-CWE-Other

{"id": "CVE-2023-40708", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "ot-cert@dragos.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2023-08-24T17:15:09.067", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-02", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ot-cert@dragos.com"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-02", "tags": ["Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "ot-cert@dragos.com", "description": [{"lang": "en", "value": "CWE-1188"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "The File Transfer Protocol (FTP) port is open by default in the SNAP PAC S1 Firmware version R10.3b. This could allow an adversary to access some device files."}], "lastModified": "2024-11-21T08:20:00.317", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:opto22:snap_pac_s1_firmware:r10.3b:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "98B7A05C-5A8D-4AA5-ADCF-9F23CCBB8DEB"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:opto22:snap_pac_s1:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2315B03D-3FA8-4C03-B1C0-867CB370D869"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ot-cert@dragos.com"}