Vulnerability · Published Dec 19, 2023 · Assigned by icscert

CVE-2023-6689Cross-Site Request Forgery in EFACEC BCU 500

High 8.2

In plain English

A high-severity cross-site request forgery in BCU 500 from EFACEC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.3%top 83.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A successful CSRF attack could force the user to perform state changing requests on the application. If the victim is an administrative account, a CSRF attack could compromise the entire web application.

Affected products (as reported)

Vendor	Product	Versions
EFACEC	BCU 500	version 4.07

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:H

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-02 government-resource