Input Validation Flaw in Phoenix SecureCore Technology Product
CVE-2023-5058

7.8HIGH

Key Information:

Vendor

Phoenix

Status
Securecore™ Technology™ 4
Vendor
CVE Published:
7 December 2023

What is CVE-2023-5058?

The vulnerability occurs due to improper input validation in the processing of user-supplied splash screens during system boot in Phoenix SecureCore Technology 4. This can lead to denial-of-service attacks, resulting in system unavailability, or allow an attacker to execute arbitrary code with system privileges, potentially compromising the security of the device.

Affected Version(s)

SecureCore™ Technology™ 4 4.0

References

https://www.phoenix.com/security-notifications/
https://www.phoenix.com/security-notifications/cve-2023-5...
https://www.kb.cert.org/vuls/id/811862

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.