CVE-2023-27408
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
A vulnerability in SCALANCE LPE9403 (versions < V2.1) is that the `i2c` mutex file is created with permissions `-rw-rw-rw-`. An authenticated attacker with SSH access could interfere with the integrity of the mutex and the data it protects.
Risk Assessment
May lead to integrity compromise of device communication and data. It requires SSH access but lowers the barrier for an attacker with valid credentials.
Recommendation
Update SCALANCE LPE9403 to version V2.1 or later. Restrict SSH access to the device to necessary accounts and networks.
Other vulnerabilities in SCALANCE LPE9403
See all- CVE-2023-27407Critical
A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). The web-based management of affected device does not properly validate user input, making it susceptible to command injection. This could allow an authenticated remote attacker to access the underlying operating system as the root user.
- CVE-2025-40583Medium
A vulnerability in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) with SINEMA Remote Connect Edge Client installed (versions before V2.1 HF0) causes transmission of sensitive information in cleartext. A privileged local attacker could retrieve this information.
- CVE-2025-40582High
SCALANCE LPE9403 devices with SINEMA Remote Connect Edge Client installed do not properly sanitize configuration parameters. This allows a non-privileged local attacker to execute root commands on the device.
- CVE-2025-40581High
SCALANCE LPE9403 devices with SINEMA Remote Connect Edge Client installed are vulnerable to an authentication bypass. A non-privileged local attacker can bypass the client's authentication and read and modify configuration parameters.
- CVE-2023-27409Low
SCALANCE LPE9403 (versions < V2.1) contains a path traversal vulnerability in the `deviceinfo` binary via the `mac` parameter. An authenticated attacker with SSH access can read the contents of any file named `address`.
Original NVD description (English source)
A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). The `i2c` mutex file is created with the permissions bits of `-rw-rw-rw-`. This file is used as a mutex for multiple applications interacting with i2c. This could allow an authenticated attacker with access to the SSH interface on the affected device to interfere with the integrity of the mutex and the data it protects.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS