What is the CVSS score of CVE-2023-5630?

CVE-2023-5630 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Eb450 Firmware CVE-2023-5630

MEDIUM

Download of Code Without Integrity Check (CWE-494)

2023-12-14 cybersecurity@se.com

Information Disclosure Eb450 Firmware Eb45E Firmware Eh450 Firmware Eh45E Firmware Er450 Firmware Er45E Firmware Jr240 Firmware Jr900 Firmware Qr450 Firmware Qr150 Firmware Qb450 Firmware Qb150 Firmware Qp450 Firmware Qp150 Firmware Qh450 Firmware Qh150 Firmware

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

CVE Published

Dec 14, 2023 - 05:15 nvd

MEDIUM 4.9

DescriptionNVD

A CWE-494: Download of Code Without Integrity Check vulnerability exists that could allow a privileged user to install an untrusted firmware.

AnalysisAI

A CWE-494: Download of Code Without Integrity Check vulnerability exists that could allow a privileged user to install an untrusted firmware. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-494. A CWE-494: Download of Code Without Integrity Check vulnerability exists that could allow a privileged user to install an untrusted firmware. Affected products include: Schneider-Electric Eb450 Firmware, Schneider-Electric Eb45E Firmware, Schneider-Electric Eh450 Firmware, Schneider-Electric Eh45E Firmware, Schneider-Electric Er450 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.