{"timestamp":"2024-01-16T16:05:53.153585Z","id":"CVE-2023-5253","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Nozomi Networks","product":"Guardian","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"23.3.0","versionType":"semver","status":"affected"}]},{"vendor":"Nozomi Networks","product":"CMC","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"23.3.0","versionType":"semver","status":"affected"}]}]

https://security.nozominetworks.com/NN-2023:12-01

A missing authentication check in the WebSocket channel used for the Check Point IoT integration in Nozomi Networks Guardian and CMC, may allow an unauthenticated attacker to obtain assets data without authentication.



Malicious unauthenticated users with knowledge on the underlying system may be able to extract asset information.

A missing authentication check in the WebSocket channel used for the Check Point IoT integration in Nozomi Networks Guardian and CMC, may allow an unauthenticated attacker to obtain assets data without authentication.



Malicious unauthenticated users with knowledge on the underlying system may be able to extract limited asset information.

A missing authentication check in the WebSocket channel used for the Check Point IoT integration in Nozomi Networks Guardian and CMC, may allow an unauthenticated attacker to obtain assets data without authentication.



Malicious unauthenticated users with knowledge on the underlying system may be able to extract asset information.

A missing authentication check in the WebSocket channel used for the Check Point IoT integration in Nozomi Networks Guardian and CMC, may allow an unauthenticated attacker to obtain assets data without authentication.



Malicious unauthenticated users with knowledge on the underlying system may be able to extract asset information.

Nozomi Networks Inc. CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NIST CWE-306

OR
     *cpe:2.3:a:nozominetworks:cmc:*:*:*:*:*:*:*:* versions up to (excluding) 23.3.0
     *cpe:2.3:a:nozominetworks:guardian:*:*:*:*:*:*:*:* versions up to (excluding) 23.3.0

https://security.nozominetworks.com/NN-2023:12-01 No Types Assigned

https://security.nozominetworks.com/NN-2023:12-01 Third Party Advisory

A missing authentication check in the WebSocket channel used for the Check Point IoT integration in Nozomi Networks Guardian and CMC, may allow an unauthenticated attacker to obtain assets data without authentication.



Malicious unauthenticated users with knowledge on the underlying system may be able to extract asset information.

Nozomi Networks Inc. AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Nozomi Networks Inc. CWE-306

Nozomi Networks Inc. https://security.nozominetworks.com/NN-2023:12-01 [No types assigned]