CVE-2023-0897 - Vulnerability Details - OpenCVE

Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session being visible in requests.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Sielco	Polyeco1000 Polyeco1000 Firmware Polyeco300 Polyeco300 Firmware Polyeco500 Polyeco500 Firmware

Configuration 1 [-]

AND

OR	cpe:2.3:o:sielco:polyeco500_firmware:1.7.0::::cpu:::
	cpe:2.3:o:sielco:polyeco500_firmware:10.16::::fpga:::

cpe:2.3:h:sielco:polyeco500:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

OR	cpe:2.3:o:sielco:polyeco300_firmware:2.0.0::::cpu:::
	cpe:2.3:o:sielco:polyeco300_firmware:2.0.2::::cpu:::
	cpe:2.3:o:sielco:polyeco300_firmware:10.19::::fpga:::

cpe:2.3:h:sielco:polyeco300:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

OR	cpe:2.3:o:sielco:polyeco1000_firmware:1.9.3::::cpu:::
	cpe:2.3:o:sielco:polyeco1000_firmware:1.9.4::::cpu:::
	cpe:2.3:o:sielco:polyeco1000_firmware:2.0.6::::cpu:::
	cpe:2.3:o:sielco:polyeco1000_firmware:10.19::::fpga:::

cpe:2.3:h:sielco:polyeco1000:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07

History

Thu, 16 Jan 2025 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2023-10-26T19:44:01.703Z

Updated: 2025-01-16T21:27:45.701Z

Reserved: 2023-02-17T21:23:31.932Z

Link: CVE-2023-0897

Vulnrichment

Updated: 2024-08-02T05:24:34.649Z

NVD

Status : Modified

Published: 2023-10-26T20:15:08.417

Modified: 2024-11-21T07:38:03.260

Link: CVE-2023-0897

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-0897", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2023-02-17T21:23:31.932Z", "datePublished": "2023-10-26T19:44:01.703Z", "dateUpdated": "2025-01-16T21:27:45.701Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "PolyEco1000", "vendor": "Sielco ", "versions": [{"status": "affected", "version": "CPU:2.0.6 FPGA:10.19"}, {"status": "affected", "version": "CPU:1.9.4 FPGA:10.19"}, {"status": "affected", "version": "CPU:1.9.3 FPGA:10.19"}, {"status": "affected", "version": "CPU:1.7.0 FPGA:10.16"}, {"status": "affected", "version": "CPU:2.0.2 FPGA:10.19"}, {"status": "affected", "version": "CPU:2.0.0 FPGA:10.19"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": " Gjoko Krstic"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<p>Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session being visible in requests.</p><br>\n\n"}], "value": "\nSielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session being visible in requests.\n\n\n\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-384", "description": "CWE-384 Session Fixation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2023-10-26T19:44:01.703Z"}, "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07"}], "source": {"discovery": "UNKNOWN"}, "title": "Session FIxation in Sielco PolyEco1000", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T05:24:34.649Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-16T21:20:00.626921Z", "id": "CVE-2023-0897", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-16T21:27:45.701Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T05:24:34.649Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-0897", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-01-16T21:20:00.626921Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-16T21:20:02.443Z"}}], "cna": {"title": "Session FIxation in Sielco PolyEco1000", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": " Gjoko Krstic"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Sielco ", "product": "PolyEco1000", "versions": [{"status": "affected", "version": "CPU:2.0.6 FPGA:10.19"}, {"status": "affected", "version": "CPU:1.9.4 FPGA:10.19"}, {"status": "affected", "version": "CPU:1.9.3 FPGA:10.19"}, {"status": "affected", "version": "CPU:1.7.0 FPGA:10.16"}, {"status": "affected", "version": "CPU:2.0.2 FPGA:10.19"}, {"status": "affected", "version": "CPU:2.0.0 FPGA:10.19"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "\nSielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session being visible in requests.\n\n\n\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n<p>Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session being visible in requests.</p><br>\n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-384", "description": "CWE-384 Session Fixation"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2023-10-26T19:44:01.703Z"}}}, "cveMetadata": {"cveId": "CVE-2023-0897", "state": "PUBLISHED", "dateUpdated": "2025-01-16T21:27:45.701Z", "dateReserved": "2023-02-17T21:23:31.932Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2023-10-26T19:44:01.703Z", "assignerShortName": "icscert"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:sielco:polyeco500_firmware:1.7.0:*:*:*:cpu:*:*:*", "matchCriteriaId": "E64F96A4-542A-486E-AC9A-3EC1E68A6D1E", "vulnerable": true}, {"criteria": "cpe:2.3:o:sielco:polyeco500_firmware:10.16:*:*:*:fpga:*:*:*", "matchCriteriaId": "E3A4049B-D0B2-4CB6-8B31-ECD3BF4FF384", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:sielco:polyeco500:-:*:*:*:*:*:*:*", "matchCriteriaId": "D7E931F0-5608-4F24-821B-3DB29972C077", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:sielco:polyeco300_firmware:2.0.0:*:*:*:cpu:*:*:*", "matchCriteriaId": "BBA5260D-A7D3-4973-8106-E8C73F50A6CE", "vulnerable": true}, {"criteria": "cpe:2.3:o:sielco:polyeco300_firmware:2.0.2:*:*:*:cpu:*:*:*", "matchCriteriaId": "F7CE9236-A970-49F0-A200-84BC3B77CECB", "vulnerable": true}, {"criteria": "cpe:2.3:o:sielco:polyeco300_firmware:10.19:*:*:*:fpga:*:*:*", "matchCriteriaId": "D45CE1CD-FB47-4FFD-974E-B55B569A5850", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:sielco:polyeco300:-:*:*:*:*:*:*:*", "matchCriteriaId": "05832105-6C9E-4850-A145-F3E241058CCA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:sielco:polyeco1000_firmware:1.9.3:*:*:*:cpu:*:*:*", "matchCriteriaId": "991B1AD8-671D-4EF9-901B-0834748258F5", "vulnerable": true}, {"criteria": "cpe:2.3:o:sielco:polyeco1000_firmware:1.9.4:*:*:*:cpu:*:*:*", "matchCriteriaId": "FE961B31-1553-4457-8436-8F9662AA10CA", "vulnerable": true}, {"criteria": "cpe:2.3:o:sielco:polyeco1000_firmware:2.0.6:*:*:*:cpu:*:*:*", "matchCriteriaId": "0BF0380D-483C-4B14-BF42-AC1E9C79D2DE", "vulnerable": true}, {"criteria": "cpe:2.3:o:sielco:polyeco1000_firmware:10.19:*:*:*:fpga:*:*:*", "matchCriteriaId": "F0E5773E-8842-4FCB-80BD-266A237042E7", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:sielco:polyeco1000:-:*:*:*:*:*:*:*", "matchCriteriaId": "01DB9D87-6F35-4171-AD59-9B90386F431E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "\nSielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session being visible in requests.\n\n\n\n\n"}, {"lang": "es", "value": "Sielco PolyEco1000 es afectada por una vulnerabilidad de secuestro de sesi\u00f3n debido a que la cookie es vulnerable a un ataque de fuerza bruta, falta de SSL y la sesi\u00f3n es visible en las solicitudes."}], "id": "CVE-2023-0897", "lastModified": "2024-11-21T07:38:03.260", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-10-26T20:15:08.417", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-384"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-384"}], "source": "nvd@nist.gov", "type": "Primary"}]}