CVE-2023-5253 — Check Point IoT integration: WebSocket returns assets data without authentication in Guardian/CMC before 23.3.0

CVE-2023-5253

Check Point IoT integration: WebSocket returns assets data without authentication in Guardian/CMC before 23.3.0 PUBLISHED

Description (CNA)

A missing authentication check in the WebSocket channel used for the Check Point IoT integration in Nozomi Networks Guardian and CMC, may allow an unauthenticated attacker to obtain assets data without authentication. Malicious unauthenticated users with knowledge on the underlying system may be able to extract limited asset information.

Affected (CNA)

Vendor / product	Versions
Nozomi Networks / Guardian	affected 0 before 23.3.0
Nozomi Networks / CMC	affected 0 before 23.3.0

CWE

CWE-306

References

https://security.nozominetworks.com/NN-2023:12-01

ADP enrichment

CVE

No English description supplied.

https://security.nozominetworks.com/NN-2023:12-01

CISA-ADP

No English description supplied.

No references supplied.