CVE-2023-2505 : The affected products have a CSRF vulnerability that could allow an attacker to

The affected products have a CSRF vulnerability that could allow an attacker to execute code and upload malicious files.

Published 2023-05-22 22:15:10

Updated 2023-05-31 14:01:22

Source ICS-CERT

View at NVD, CVE.org

Vulnerability category: Cross-site request forgery (CSRF)Execute code

Products affected by CVE-2023-2505

Birddog » A300 Firmware » Version: 3.4
cpe:2.3:o:birddog:a300_firmware:3.4:*:*:*:*:*:*:*
Matching versions
When used together with: Birddog » A300 » Version: N/A
Birddog » Mini Firmware » Version: 2.6.2
cpe:2.3:o:birddog:mini_firmware:2.6.2:*:*:*:*:*:*:*
Matching versions
When used together with: Birddog » Mini » Version: N/A
Birddog » 4k Quad Firmware » Version: 4.5.181
cpe:2.3:o:birddog:4k_quad_firmware:4.5.181:*:*:*:*:*:*:*
Matching versions
When used together with: Birddog » 4k Quad » Version: N/A
Birddog » 4k Quad Firmware » Version: 4.5.196
cpe:2.3:o:birddog:4k_quad_firmware:4.5.196:*:*:*:*:*:*:*
Matching versions
When used together with: Birddog » 4k Quad » Version: N/A
Birddog » Studio R3 Firmware » Version: 3.6.4
cpe:2.3:o:birddog:studio_r3_firmware:3.6.4:*:*:*:*:*:*:*
Matching versions
When used together with: Birddog » Studio R3 » Version: N/A

EPSS FAQ

0.17%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 55 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.7	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N	3.1	4.0	ICS-CERT
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Changed Confidentiality: None Integrity: High Availability: None
8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Assigned by: ics-cert@hq.dhs.gov (Primary)

Jump to