Check Point IoT integration: WebSocket returns assets data without authentication in Guardian/CMC before 23.3.0
CVE-2023-5253
7.5HIGH
What is CVE-2023-5253?
A vulnerability exists in the WebSocket channel used for the IoT integration in Nozomi Networks Guardian and CMC. This flaw permits an unauthenticated attacker to access sensitive asset data without proper authentication checks. Attackers with knowledge of the system could exploit this vulnerability to extract limited asset information, potentially compromising the confidentiality of critical data. The issue underscores the necessity for robust security measures in IoT integrations to protect against unauthorized access.
Affected Version(s)
CMC 0 < 23.3.0
Guardian 0 < 23.3.0
References
CVSS V3.1
Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
This issue was found by Nozomi Networks Product Security team during an internal VAPT testing session.