CVE-2023-0897 — HIGH (8.8) — White Hats Nepal

Vulnerability Description

Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session being visible in requests.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Sielco	Polyeco500 Firmware	1.7.0
Sielco	Polyeco500	-
Sielco	Polyeco300 Firmware	2.0.0
Sielco	Polyeco300	-
Sielco	Polyeco1000 Firmware	1.9.3
Sielco	Polyeco1000	-

Related Weaknesses (CWE)

CWE-384

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07Third Party AdvisoryUS Government Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07Third Party AdvisoryUS Government Resource

FAQ

What is CVE-2023-0897?

CVE-2023-0897 is a vulnerability with a CVSS score of 8.8 (HIGH). Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session being visible in requests.

How severe is CVE-2023-0897?

CVE-2023-0897 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-0897?

Check the references section above for vendor advisories and patch information. Affected products include: Sielco Polyeco500 Firmware, Sielco Polyeco500, Sielco Polyeco300 Firmware, Sielco Polyeco300, Sielco Polyeco1000 Firmware.