Check Point IoT integration: WebSocket returns assets data without authentication in Guardian/CMC before 23.3.0
CVE-2023-5253

6.3MEDIUM

Key Information:

Vendor

Nozomi Networks

Status
Guardian
Cmc
Vendor
CVE Published:
15 January 2024

What is CVE-2023-5253?

A vulnerability exists in the WebSocket channel used for the IoT integration in Nozomi Networks Guardian and CMC. This flaw permits an unauthenticated attacker to access sensitive asset data without proper authentication checks. Attackers with knowledge of the system could exploit this vulnerability to extract limited asset information, potentially compromising the confidentiality of critical data. The issue underscores the necessity for robust security measures in IoT integrations to protect against unauthorized access.

Affected Version(s)

CMC 0 < 23.3.0

Guardian 0 < 23.3.0

References

https://security.nozominetworks.com/NN-2023:12-01

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was found by Nozomi Networks Product Security team during an internal VAPT testing session.
.