What is the CVSS score of CVE-2023-25556?

CVE-2023-25556 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Merten Instabus Tastermodul 1Fach System M Firmware CVE-2023-25556

HIGH

Improper Authentication (CWE-287)

2023-04-18 cybersecurity@se.com

Authentication Bypass Merten Instabus Tastermodul 1Fach System M Firmware Merten Instabus Tastermodul 2Fach System M Firmware Merten Tasterschnittstelle 4Fach Plus Firmware Merten Knx Argus 180 2 20M Up System Firmware Merten Jalousie Schaltaktor Reg K 8X 16X 10 M Hb Firmware Merten Knx Uni Dimmaktor Ll Reg K 2X230 300 W Firmware Merten Knx Schaltakt 2X6A Up M 2 Eing Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Apr 18, 2023 - 18:15 nvd

HIGH 8.8

DescriptionNVD

AnalysisAI

A CWE-287: Improper Authentication vulnerability exists that could allow a device to be compromised when a key of less than seven digits is entered and the attacker has access to the KNX installation. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. A CWE-287: Improper Authentication vulnerability exists that could allow a device to be compromised when a key of less than seven digits is entered and the attacker has access to the KNX installation. Affected products include: Schneider-Electric Merten Instabus Tastermodul 1Fach System M Firmware, Schneider-Electric Merten Instabus Tastermodul 2Fach System M Firmware, Schneider-Electric Merten Tasterschnittstelle 4Fach Plus Firmware, Schneider-Electric Merten Knx Argus 180\/2\,20M Up System Firmware, Schneider-Electric Merten Jalousie-\/Schaltaktor Reg-K\/8X\/16X\/10 M. Hb Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.