CVE-2023-1514CWE-295

A vulnerability exists in the component RTU500 Scripting interface

High · published December 19, 2023

CVSS v3.1
7.4
EPSS
0%
Percentile
23.3
In the wild
Unconfirmed
What it is

A vulnerability exists in the component RTU500 Scripting interface. When a client connects to a server using TLS, the server presents a certificate. This certificate links a public key to the identity of the service and is signed by a Certification Authority (CA), allowing the client to validate that the remote service can be trusted and is not malicious. If the client does not validate the parameters of the certificate, then attackers could be able to spoof the identity of the service. An attacker could exploit the vulnerability by using faking the identity of a RTU500 device and intercepting the messages initiated via the RTU500 Scripting interface.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00316 · 23.3th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2023-12-19T14:22Z
EPSS history
Timeline
  • 19 DEC 14:22Z
    A vulnerability exists in the component RTU500 Scripting interface
    cvelistv5