« Volver al listado

CVE-2023-4523

Estado: ModificadaMedia (6.1)—

Real Time Automation 460 Series products with versions prior to v8.9.8 are vulnerable to cross-site scripting, which could allow an attacker to run any JavaScript reference from the URL string. If this were to occur, the gateway's HTTP interface would redirect to the main page, which is index.htm.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Rtautomation — 460 Series Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-4523",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-4523",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-01-16T21:22:53.987113Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "ics-cert@hq.dhs.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.4,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.5,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "affectedData": [
        {
          "vendor": "Real Time Automation",
          "product": "460 Series",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "v8.9.8",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-09-27T19:15:12.373",
  "references": [
    {
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-264-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-264-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "ics-cert@hq.dhs.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "\nReal Time Automation 460 Series products with versions prior to v8.9.8 are vulnerable to cross-site scripting, which could allow an attacker to run any JavaScript reference from the URL string. If this were to occur, the gateway's HTTP interface would redirect to the main page, which is index.htm.\n\n"
    },
    {
      "lang": "es",
      "value": "Los productos Real Time Automation Serie 460 con versiones anteriores a la v8.9.8 son vulnerables a Cross-Site Scripting (XSS), lo que podría permitir a un atacante ejecutar cualquier referencia de JavaScript desde la cadena URL. Si esto ocurriera, la interfaz HTTP de la puerta de enlace redirigiría a la página principal, que es index.htm."
    }
  ],
  "lastModified": "2026-06-17T06:38:00.970",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:rtautomation:460_series_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C4FDC938-0147-4234-A952-0787C371E2DE",
              "versionEndExcluding": "8.9.8"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:rtautomation:460etcmm:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "5D1F8BBC-0375-4EF8-A2B7-06CAE092672E"
            },
            {
              "criteria": "cpe:2.3:h:rtautomation:460mcbms:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "E4B3529A-8801-4703-BC36-224F58E314B4"
            },
            {
              "criteria": "cpe:2.3:h:rtautomation:460mcbs:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "B3677DE5-0183-41AB-9A47-AA7413B55948"
            },
            {
              "criteria": "cpe:2.3:h:rtautomation:460mmbms:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "9CACBF19-7A0A-4632-985C-44A677454F52"
            },
            {
              "criteria": "cpe:2.3:h:rtautomation:460mmbs:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "20F5B7AC-5BD2-432D-91FE-BACB5DABAFD3"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov"
}