CVE-2023-24062

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-24062
Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR12, 4.0.0 SR04, 4.1.0 SR02, and 4.2.0 SR01 fails to validate the directory structure of the root file system during the Pre-Boot Authorization (PBA) process. This can be exploited by a physical attacker who is able to manipulate the contents of the system's hard disk.

6.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 5.9

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Matt%20Burch%20-%20Where%E2%80%99s%20the%20Money%20-%20Defeating%20ATM%20Disk%20Encryption-white%20paper.pdf Exploit Third Party Advisory
https://www.dieboldnixdorf.com/en-us/banking/portfolio/software/security/ Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:dieboldnixdorf:vynamic_security_suite:*:*:*:*:*:*:*:*
cpe:2.3:a:dieboldnixdorf:vynamic_security_suite:*:*:*:*:*:*:*:*
cpe:2.3:a:dieboldnixdorf:vynamic_security_suite:*:*:*:*:*:*:*:*
cpe:2.3:a:dieboldnixdorf:vynamic_security_suite:*:*:*:*:*:*:*:*
History

19 Aug 2024, 19:05

Type Values Removed Values Added
CPE cpe:2.3:a:dieboldnixdorf:vynamic_security_suite:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.8
References () https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Matt%20Burch%20-%20Where%E2%80%99s%20the%20Money%20-%20Defeating%20ATM%20Disk%20Encryption-white%20paper.pdf - () https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Matt%20Burch%20-%20Where%E2%80%99s%20the%20Money%20-%20Defeating%20ATM%20Disk%20Encryption-white%20paper.pdf - Exploit, Third Party Advisory
References () https://www.dieboldnixdorf.com/en-us/banking/portfolio/software/security/ - () https://www.dieboldnixdorf.com/en-us/banking/portfolio/software/security/ - Vendor Advisory
CWE NVD-CWE-noinfo
First Time Dieboldnixdorf
Dieboldnixdorf vynamic Security Suite
Summary
  • (es) Diebold Nixdorf Vynamic Security Suite (VSS) anterior a 3.3.0 SR12, 4.0.0 SR04, 4.1.0 SR02 y 4.2.0 SR01 no puede validar la estructura de directorios del sistema de archivos raíz durante el proceso de autorización previa al inicio (PBA) . Esto puede ser aprovechado por un atacante físico que pueda manipular el contenido del disco duro del sistema.

08 Aug 2024, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-08 18:15

Updated : 2024-08-19 19:05

NVD link : CVE-2023-24062

Mitre link : CVE-2023-24062

CVE.ORG link : CVE-2023-24062

JSON object : View

Products Affected

dieboldnixdorf

  • vynamic_security_suite
CWE
NVD-CWE-noinfo