{"id":"CVE-2023-27462","state":"PUBLISHED","title":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.3). The client query handler of the affected application fails to check for proper permissions for spec","description":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.3). The client query handler of the affected application fails to check for proper permissions for specific read queries. This could allow authenticated remote attackers to access data they are not authorized for.","publishedAt":"2023-03-14T09:32:08.607Z","updatedAt":"2025-02-27T15:59:48.613Z","severity":{"score":3.1,"label":"Low","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C","source":"siemens"},"assigner":"siemens","products":["Siemens RUGGEDCOM CROSSBOW"],"affected":[{"vendor":"Siemens","product":"RUGGEDCOM CROSSBOW","defaultStatus":"unknown","versions":[{"version":"All versions < V5.3","status":"affected"}]}],"references":["https://cert-portal.siemens.com/productcert/pdf/ssa-320629.pdf"],"weaknesses":["CWE-862"],"ingestedAt":"2026-10-29T20:05:52.290Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/27xxx/CVE-2023-27462.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-27462","state":"PUBLISHED","datePublished":"2023-03-14T09:32:08.607Z","dateUpdated":"2025-02-27T15:59:48.613Z","assignerShortName":"siemens","assignerOrgId":"cec7a2ec-15b4-4faf-bd53-b40f371f3a77","dateReserved":"2023-03-01T17:29:28.823Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.3). The client query handler of the affected application fails to check for proper permissions for specific read queries. This could allow authenticated remote attackers to access data they are not authorized for."}],"affected":[{"vendor":"Siemens","product":"RUGGEDCOM CROSSBOW","defaultStatus":"unknown","versions":[{"version":"All versions < V5.3","status":"affected"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-320629.pdf"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C","baseScore":3.1,"baseSeverity":"LOW"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","lang":"en","description":"CWE-862: Missing Authorization","type":"CWE"}]}],"providerMetadata":{"shortName":"siemens","orgId":"cec7a2ec-15b4-4faf-bd53-b40f371f3a77","dateUpdated":"2023-03-14T09:32:08.607Z"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-320629.pdf","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T12:09:43.431Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-02-27T15:59:39.445388Z","id":"CVE-2023-27462","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-27T15:59:48.613Z"}}]}}}