Skip to content
OpenAdvisories
High ICSA-23-269-05 3 CVEs

Baker Hughes Bently Nevada 3500

Published Sep 26, 2023 · Updated Sep 26, 2023

Vendor: Baker Hughes - Bently Nevada Product: Bently Nevada 3500 Rack (TDI Firmware)

Summary

Successful exploitation of these vulnerabilities could allow an attacker to steal sensitive information and gain access to the device.

Vulnerabilities 3

  • High 7.5
    CVE-2023-34437

    Baker Hughes Bently Nevada 3500 System Incorrect Permission Assignment for Critical Resource

    Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a vulnerability in their password retrieval functionality which could allow an attacker to access passwords stored on the device.

    Baker Hughes - Bently Nevada Bently Nevada 3500 System
  • Medium 6.8
    CVE-2023-34441

    Baker Hughes Bently Nevada 3500 System Cleartext Transmission of Sensitive Information

    Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a cleartext transmission vulnerability which could allow an attacker to steal the authentication secret from communication traffic to the device and reuse it for arbitrary requests.

    Baker Hughes - Bently Nevada Bently Nevada 3500 System
  • Medium 5.4
    CVE-2023-36857

    Baker Hughes Bently Nevada 3500 System Authentication Bypass by Capture-replay

    Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a replay vulnerability which could allow an attacker to replay older captured packets of traffic to the device to gain access.

    Baker Hughes - Bently Nevada Bently Nevada 3500 System

Revision history

  1. #1

    Initial Publication

References