CVE-2023-43633

CVSS 3.1 Score 8.8 of 10 (high)

Details

Published Sep 21, 2023
Updated: Oct 16, 2023
CWE ID 522
CWE ID 922

Summary

CVE-2023-43633 is a vulnerability that affects multiple products (identified by the affected_products field) and allows an attacker to gain full control over the device. On boot, the Pillar eve container checks for the existence and content of a specific file ("/config/GlobalConfig/global.json"). If the file exists, it overrides the existing configuration on the device. This can be exploited by an attacker to change the system's configuration, including enabling debug functionalities such as unlocking SSH, enabling USB keyboard access, allowing VNC access, and more. The "measured boot" mechanism implemented by EVE OS is not triggered by these changes, making it possible for an attacker to modify the device's configuration without detection. The vulnerability poses a high risk to organizations as it could result in unauthorized access and control over affected devices.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-43633 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options