Keysight Geolocation Server Exposed Dangerous Method or Function
CVE-2023-36853

7.8HIGH

Key Information:

Vendor

Keysight Technologies

Status
N6845a Geolocation Server
Vendor
CVE Published:
19 July 2023

What is CVE-2023-36853?

In Keysight Geolocation Server versions prior to 2.4.2, a low privileged attacker could exploit a vulnerability that allows them to create a ZIP file containing a malicious script. This script could be placed in any directory, enabling the attacker to execute a DLL with SYSTEM privileges, potentially compromising the integrity of the system.

Affected Version(s)

N6845A Geolocation Server 0 <= 2.4.2

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-1...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

​Steven Seeley of Source Incite reported these vulnerabilities to CISA.
.