CVE-2023-23588: microchip maxview_storage_manager

Vulnerability summary

CVE-2023-23588 is a medium (CVSS 6.3) vulnerability in microchip maxview_storage_manager. EPSS estimates a 0.09% chance of exploitation in the next 30 days, higher than 0.4% of scored vulnerabilities.

Timeline

1. 11-04-2023
   PublishedVulnerability first disclosed.
2. 15-10-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability has been identified in SIMATIC IPC1047 (All versions), SIMATIC IPC1047E (All versions with maxView Storage Manager < 4.09.00.25611 on Windows), SIMATIC IPC647D (All versions), SIMATIC IPC647E (All versions with maxView Storage Manager < 4.09.00.25611 on Windows), SIMATIC IPC847D (All versions), SIMATIC IPC847E (All versions with maxView Storage Manager < 4.09.00.25611 on Windows). The Adaptec Maxview application on affected devices is using a non-unique TLS certificate across installations to protect the communication from the local browser to the local application. A local attacker may use this key to decrypt intercepted local traffic between the browser and the application and could perform a man-in-the-middle attack in order to modify data in transit.

• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
• CWE-295Improper Certificate ValidationThe product does not validate, or incorrectly validates, a certificate.