Vulnerability record/PUBLISHED/Published Dec 19, 2023 15:09:13 UTC
CVE-2023-43870
When installing the Net2 software a root certificate is installed into the trusted store. A potential hacker could access the installer batch file or reverse engineer the source code to gain access to the root certificate password. Using the root certificate and password they could then create their own certificates to emulate another site. Then by establishing a proxy service to emulate the site they could monitor traffic passed between the end user and the site allowing access to the data content.
Base score8.1/ 10
SeverityHighCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityHigh
Attack vectorNetworkAV
Attack complexityLowAC
Privileges requiredNonePR
User interactionRequiredUI
ScopeUnchangedS
Confidentiality impactHighC
Integrity impactHighI
Availability impactNoneA
CVSS vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityNCSC-NL
Last updatedNov 27, 2024 20:03:30 UTC
PublishedDec 19, 2023 15:09:13 UTC
ReservedSep 25, 2023 07:14:20 UTC
Credits
- Jeroen Hermans, CloudAware, j.hermans@cloudaware[.]eu