Gvip
Monthly
Improper IAM permission configuration in NXP GoldVIP's SitewiseCustomFunction Lambda Function Handler exposes AWS resources to remote attackers holding high-privilege credentials in the affected environment. The flaw, tracked as CWE-284, allows authorized high-privileged principals to exceed their intended access boundaries within the AWS deployment - a misconfigured IAM role rather than a missing authentication check. The vendor acknowledged this as a known historical issue resolved beginning with version 1.13.0 and fully addressed in 1.15.0; no public exploit code or active exploitation has been identified at time of analysis.
Improper IAM permission configuration in NXP GoldVIP's SitewiseCustomFunction Lambda Function Handler exposes AWS resources to remote attackers holding high-privilege credentials in the affected environment. The flaw, tracked as CWE-284, allows authorized high-privileged principals to exceed their intended access boundaries within the AWS deployment - a misconfigured IAM role rather than a missing authentication check. The vendor acknowledged this as a known historical issue resolved beginning with version 1.13.0 and fully addressed in 1.15.0; no public exploit code or active exploitation has been identified at time of analysis.