6.5
CVE-2023-3395
- EPSS 0.04%
- Veröffentlicht 03.07.2023 21:15:10
- Zuletzt bearbeitet 21.11.2024 08:17:10
- Quelle ics-cert@hq.dhs.gov
- CVE-Watchlists
- Unerledigt
LoginAll versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. An attacker with access to system files could open a file to load the document into memory, including sensitive information associated with document, such as password. The attacker could then obtain the plaintext password by using a memory viewer.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ovarro ≫ Tbox Ms-cpu32 Firmware Version-
Ovarro ≫ Tbox Ms-cpu32-s2 Firmware Version-
Ovarro ≫ Tbox Lt2 Firmware Version-
Ovarro ≫ Tbox Tg2 Firmware Version-
Ovarro ≫ Tbox Rm2 Firmware Version-
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.04% | 0.112 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.5 | 2.8 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
|
| ics-cert@hq.dhs.gov | 6.5 | 2.8 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
|
CWE-256 Plaintext Storage of a Password
Storing a password in plaintext may result in a system compromise.
CWE-312 Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.