« Volver al listado

CVE-2023-7007

Estado: AplazadaAlta (8.2)—

El servidor Sciener no valida las solicitudes de conexión de GatewayG2, lo que permite un ataque de suplantación de identidad que proporciona al atacante el campo unlockKey.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Sciener — Gatewayg2AISciener — Sciener ServerAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-7007",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-7007",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-03-18T16:16:50.033419Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "Sciener",
          "product": "Gateway G2",
          "versions": [
            {
              "status": "affected",
              "version": "6.0.0",
              "versionType": "custom",
              "lessThanOrEqual": "6.0.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-03-15T17:15:07.763",
  "references": [
    {
      "url": "https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/",
      "source": "cret@cert.org"
    },
    {
      "url": "https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.kb.cert.org/vuls/id/949046",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "Sciener server does not validate connection requests from the GatewayG2, allowing an impersonation attack that provides the attacker the unlockKey field."
    },
    {
      "lang": "es",
      "value": "El servidor Sciener no valida las solicitudes de conexión de GatewayG2, lo que permite un ataque de suplantación de identidad que proporciona al atacante el campo unlockKey."
    }
  ],
  "lastModified": "2026-06-17T06:51:51.383",
  "sourceIdentifier": "cret@cert.org"
}