Vulnerability · Published Jan 25, 2023 · Assigned by INCIBE

CVE-2023-0321Disclosure of Sensitive Information on Campbell Scientific Products

Critical 9.1

In plain English

A critical-severity information exposure in CR1000 from Campbell Scientific. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.9%top 40.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Campbell Scientific dataloggers CR6, CR300, CR800, CR1000 and CR3000 may allow an attacker to download configuration files, which may contain sensitive information about the internal network. From factory defaults, the mentioned datalogges have HTTP and PakBus enabled. The devices, with the default configuration, allow this situation via the PakBus port. The exploitation of this vulnerability may allow an attacker to download, modify, and upload new configuration files.

Affected products (as reported)

Vendor	Product	Versions
Campbell Scientific	CR6	all version
Campbell Scientific	CR300	all version
Campbell Scientific	CR800	all version
Campbell Scientific	CR1000	all version
Campbell Scientific	CR3000	all version

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

In plain English

Official description

Affected products (as reported)

References