Severity
Medium
Analysis Summary
CVE-2023-27309 CVSS:5
Siemens RUGGEDCOM CROSSBOW could allow a remote authenticated attacker to gain elevated privileges on the system, caused by failing to check for proper permissions when assigning groups to user accounts. By sending a specially crafted request, an attacker could exploit this vulnerability to o assign administrative groups to otherwise non-privileged user accounts.
CVE-2023-27310 CVSS:6.6
Siemens RUGGEDCOM CROSSBOW could allow a remote authenticated attacker to gain elevated privileges on the system, caused by failing to check for proper permissions when assigning groups to user accounts. By sending a specially crafted request, an attacker could exploit this vulnerability to o assign administrative groups to otherwise non-privileged user accounts.
Impact
- Privilege Escalation
Indicators Of Compromise
CVE
- CVE-2023-27309
- CVE-2023-27310
Affected Vendors
Siemens
Affected Products
- Siemens RUGGEDCOM CROSSBOW 5.1
Remediation
Refer to Siemens Security Advisory for patch, upgrade or suggested workaround information.