CVE-2023-35120
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
PiiGAB M-Bus is vulnerable to cross-site request forgery (CSRF). An attacker can send a phishing email to the device owner, hoping they will click on a link, which could result in unauthorized command execution.
Risk Assessment
The risk to the organization involves the potential for unauthorized command execution on the device, which could lead to loss of control over the system or data leakage.
Recommendation
It is recommended to implement CSRF protection mechanisms, such as CSRF tokens, and to educate users about phishing threats.
Other vulnerabilities in PiiGAB M-Bus
See all- CVE-2023-35987Critical
PiiGAB M-Bus contains hard-coded credentials which it uses for authentication.
- CVE-2023-35765Medium
PiiGAB M-Bus stores credentials in a plaintext file, which could allow a low-level user to gain admin credentials.
- CVE-2023-34995High
The lack of requirements for setting complex passwords in PiiGAB M-Bus may lead to successful brute force attacks if the password aligns with recommended password guidelines.
- CVE-2023-34433High
PiiGAB M-Bus stores passwords using a weak hash algorithm, which may lead to easy cracking.
Original NVD description (English source)
PiiGAB M-Bus is vulnerable to cross-site request forgery. An attacker who wants to execute a certain command could send a phishing mail to the owner of the device and hope that the owner clicks on the link. If the owner of the device has a cookie stored that allows the owner to be logged in, then the device could execute the GET or POST link request.