Skip to content
OpenAdvisories
Medium WID-SEC-2023-2722 3 CVEs

Baker Hughes Bently Nevada 3500: Mehrere Schwachstellen

Published Oct 19, 2023 · Updated Oct 19, 2023 · de-DE

Vendor: Baker Hughes Product: Bently Nevada 3500 5.05

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Baker Hughes Bently Nevada 3500 ausnutzen, um Informationen offenzulegen oder Sicherheitsvorkehrungen zu umgehen.

Product

Das Bently Nevada 3500 System ist eine Echtzeit-Überwachungslösung für industrielle Zwecke.

Vulnerabilities 3

  • High 7.5
    CVE-2023-34437

    Baker Hughes Bently Nevada 3500 System Incorrect Permission Assignment for Critical Resource

    Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a vulnerability in their password retrieval functionality which could allow an attacker to access passwords stored on the device.

    Baker Hughes - Bently Nevada Bently Nevada 3500 System
  • Medium 6.8
    CVE-2023-34441

    Baker Hughes Bently Nevada 3500 System Cleartext Transmission of Sensitive Information

    Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a cleartext transmission vulnerability which could allow an attacker to steal the authentication secret from communication traffic to the device and reuse it for arbitrary requests.

    Baker Hughes - Bently Nevada Bently Nevada 3500 System
  • Medium 5.4
    CVE-2023-36857

    Baker Hughes Bently Nevada 3500 System Authentication Bypass by Capture-replay

    Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a replay vulnerability which could allow an attacker to replay older captured packets of traffic to the device to gain access.

    Baker Hughes - Bently Nevada Bently Nevada 3500 System

Revision history

  1. #1

    Initiale Fassung

References