CVE-2023-27310 MEDIUM

CVE-2023-27310

Vendor Siemens
Product RUGGEDCOM CROSSBOW
Weakness CWE-862 · Missing authorization
Published March 14, 2023
Last update February 27, 2025

CVSS base score

6.6/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

What the vulnerability does

01Description

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.2). The client query handler of the affected application fails to check for proper permissions when assigning groups to user accounts. This could allow an authenticated remote attacker to assign administrative groups to otherwise non-privileged user accounts.

Key dates

02Disclosure timeline

March 14, 2023 CVE published
February 27, 2025 Record updated

Related vulnerabilities

04Related CVE