CVE-2023-28727 : Panasonic AiSEG2 versions 2.00J through 2.93A allows adjacent attackers bypass a

Panasonic AiSEG2 versions 2.00J through 2.93A allows adjacent attackers bypass authentication due to mishandling of X-Forwarded-For headers.

Published 2023-03-31 07:15:07

Updated 2023-04-06 18:24:54

View at NVD, CVE.org

Vulnerability category: BypassGain privilege

Products affected by CVE-2023-28727

Panasonic » Aiseg2 Firmware
Versions from including (>=) 2.00j and up to, including, (<=) 2.93a
cpe:2.3:o:panasonic:aiseg2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Panasonic » Aiseg2 » Version: N/A

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 27 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
8.8	HIGH	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
9.6	CRITICAL	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	2.8	6.0	Panasonic Holdings Corporation
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Assigned by: nvd@nist.gov (Primary)

Jump to