CVE-2023-24062

Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR12, 4.0.0 SR04, 4.1.0 SR02, and 4.2.0 SR01 fails to validate the directory structure of the root file system during the Pre-Boot Authorization (PBA) process. This can be exploited by a physical attacker who is able to manipulate the contents of the system's hard disk.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 5.9

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Matt%20Burch%20-%20Where%E2%80%99s%20the%20Money%20-%20Defeating%20ATM%20Disk%20Encryption-white%20paper.pdf	Exploit Third Party Advisory
https://www.dieboldnixdorf.com/en-us/banking/portfolio/software/security/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:dieboldnixdorf:vynamic_security_suite::::::::
	cpe:2.3:a:dieboldnixdorf:vynamic_security_suite::::::::
	cpe:2.3:a:dieboldnixdorf:vynamic_security_suite::::::::
	cpe:2.3:a:dieboldnixdorf:vynamic_security_suite::::::::

History

18 Mar 2025, 19:15

Type	Values Removed	Values Added
CWE		CWE-20

Information

Published : 2024-08-08 18:15

Updated : 2025-03-18 19:15

NVD link : CVE-2023-24062

Mitre link : CVE-2023-24062

CVE.ORG link : CVE-2023-24062

JSON object : View

Products Affected

dieboldnixdorf

vynamic_security_suite

CWE

NVD-CWE-noinfo CWE-20

Improper Input Validation

{"id": "CVE-2023-24062", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.9}]}, "published": "2024-08-08T18:15:09.317", "references": [{"url": "https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Matt%20Burch%20-%20Where%E2%80%99s%20the%20Money%20-%20Defeating%20ATM%20Disk%20Encryption-white%20paper.pdf", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.dieboldnixdorf.com/en-us/banking/portfolio/software/security/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR12, 4.0.0 SR04, 4.1.0 SR02, and 4.2.0 SR01 fails to validate the directory structure of the root file system during the Pre-Boot Authorization (PBA) process. This can be exploited by a physical attacker who is able to manipulate the contents of the system's hard disk."}, {"lang": "es", "value": "Diebold Nixdorf Vynamic Security Suite (VSS) anterior a 3.3.0 SR12, 4.0.0 SR04, 4.1.0 SR02 y 4.2.0 SR01 no puede validar la estructura de directorios del sistema de archivos ra\u00edz durante el proceso de autorizaci\u00f3n previa al inicio (PBA) . Esto puede ser aprovechado por un atacante f\u00edsico que pueda manipular el contenido del disco duro del sistema."}], "lastModified": "2025-03-18T19:15:41.127", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dieboldnixdorf:vynamic_security_suite:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4B70F9BC-14EC-4E38-A079-63506F242F63", "versionEndExcluding": "3.3.0sr12"}, {"criteria": "cpe:2.3:a:dieboldnixdorf:vynamic_security_suite:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A45FE84B-35D3-4E42-942B-89EB84466C8A", "versionEndExcluding": "4.0.0sr04", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:dieboldnixdorf:vynamic_security_suite:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "08A010AB-89B3-462F-B526-FDB06D2E8BC5", "versionEndExcluding": "4.1.0sr02", "versionStartIncluding": "4.1.0"}, {"criteria": "cpe:2.3:a:dieboldnixdorf:vynamic_security_suite:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "37787D11-00BE-4351-8587-D2D02F52E769", "versionEndExcluding": "4.2.0sr01", "versionStartIncluding": "4.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}