CVE-2023-28865
Last modified
CVE-2023-28865 is a medium-severity vulnerability rated 6.6/10 on the CVSS scale. Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR15, 4.0.0 SR05, 4.1.0 SR03, and 4.2.0 SR02 fails to validate the directory contents of certain directories (e.g., ensuring the expected hash sum) during the Pre-Boot Authorization (PBA) process. This can be exploited by a physical attacker who is able to manipulate the contents of the system's hard disk.. EPSS estimates a 0.26% chance of exploitation in the next 30 days.
Description
Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR15, 4.0.0 SR05, 4.1.0 SR03, and 4.2.0 SR02 fails to validate the directory contents of certain directories (e.g., ensuring the expected hash sum) during the Pre-Boot Authorization (PBA) process. This can be exploited by a physical attacker who is able to manipulate the contents of the system's hard disk.
Metrics
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Dieboldnixdorf | Vynamic Security Suite | < 3.3.0sr15 |
| Dieboldnixdorf | Vynamic Security Suite | >= 4.0.0, < 4.0.0sr05 |
| Dieboldnixdorf | Vynamic Security Suite | >= 4.1.0, < 4.1.0sr03 |
| Dieboldnixdorf | Vynamic Security Suite | >= 4.2.0, < 4.2.0sr02 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2023-28865?
How severe is CVE-2023-28865?
How do I fix CVE-2023-28865?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-28858redis-py before 4.5.3 leaves a connection open after canceli…3.7
- CVE-2023-28859redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connec…6.5
- CVE-2023-2886Missing Origin Validation in WebSockets vulnerability in CBO…4.3
- CVE-2023-28862An issue was discovered in LemonLDAP::NG before 2.16.1. Weak…9.8
- CVE-2023-28863AMI MegaRAC SPx12 and SPx13 devices have Insufficient Verifi…9.1
- CVE-2023-28864Progress Chef Infra Server before 15.7 allows a local attack…5.5
- CVE-2023-28866In the Linux kernel through 6.2.8, net/bluetooth/hci_sync.c …5.3
- CVE-2023-28867In GraphQL Java (aka graphql-java) before 20.1, an attacker …7.5
- CVE-2023-28868Support Assistant in NCP Secure Enterprise Client before 12.…8.1
- CVE-2023-28869Support Assistant in NCP Secure Enterprise Client before 12.…6.5
- CVE-2023-2887Authentication Bypass by Spoofing vulnerability in CBOT Chat…9.8
- CVE-2023-28870Insecure File Permissions in Support Assistant in NCP Secure…6.5
Are you affected by CVE-2023-28865?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST