Vulnerability · Published Nov 22, 2023 · Assigned by NX
CVE-2023-6263Server Spoofing Vulnerability in NxCloud
High 8.3
In plain English
A high-severity authentication bypass by spoofing in NxCloud from Network Optix. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Severity (CVSS 3.1)8.3High
Exploit odds (30 days)0.5%top 57.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An issue was discovered by IPVM team in Network Optix NxCloud before 23.1.0.40440. It was possible to add a fake VMS server to NxCloud by using the exact identification of a legitimate VMS server. As result, it was possible to retrieve authorization headers from legitimate users when the legitimate client connects to the fake VMS server.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Network Optix | NxCloud | 0 – before 23.1.0.40440 |
Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H