Vulnerability Description
PiiGAB M-Bus is vulnerable to cross-site request forgery. An attacker who wants to execute a certain command could send a phishing mail to the owner of the device and hope that the owner clicks on the link. If the owner of the device has a cookie stored that allows the owner to be logged in, then the device could execute the GET or POST link request.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Piigab | M-Bus 900S Firmware | - |
| Piigab | M-Bus 900S | - |
Related Weaknesses (CWE)
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-187-01Third Party AdvisoryUS Government Resource
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-187-01Third Party AdvisoryUS Government Resource
FAQ
What is CVE-2023-35120?
CVE-2023-35120 is a vulnerability with a CVSS score of 8.8 (HIGH). PiiGAB M-Bus is vulnerable to cross-site request forgery. An attacker who wants to execute a certain command could send a phishing mail to the owner of the device and hope that the owner clicks on th...
How severe is CVE-2023-35120?
CVE-2023-35120 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-35120?
Check the references section above for vendor advisories and patch information. Affected products include: Piigab M-Bus 900S Firmware, Piigab M-Bus 900S.