Vulnerability · Published Sep 5, 2023 · Assigned by talos
CVE-2023-34353
High 7.5
In plain English
A high-severity weak randomness in OAS Platform from Open Automation Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.2%top 31.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An authentication bypass vulnerability exists in the OAS Engine authentication functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted network sniffing can lead to decryption of sensitive information. An attacker can sniff network traffic to trigger this vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Open Automation Software | OAS Platform | v18.00.0072 |
Weakness: CWE-330 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N