CVE-2023-45593

A CWE-184 “Incomplete List of Disallowed Inputs” vulnerability in the embedded Chromium browser (concerning the handling of alternative URLs, other than “ http://localhost” ) allows a physical attacker to read arbitrary files on the file system, alter the configuration of the embedded browser, and have other unspecified impacts to the confidentiality, integrity, and availability of the device. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 5.9

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45593	Third Party Advisory
https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45593	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ailux:imx6:*:*:*:*:*:*:*:*

History

10 Apr 2025, 20:24

Type	Values Removed	Values Added
First Time		Ailux imx6 Ailux
CPE		cpe:2.3:a:ailux:imx6::::::::
References	~~() https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45593 -~~	() https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45593 - Third Party Advisory
CWE		NVD-CWE-noinfo

Information

Published : 2024-03-05 12:15

Updated : 2025-04-10 20:24

NVD link : CVE-2023-45593

Mitre link : CVE-2023-45593

CVE.ORG link : CVE-2023-45593

JSON object : View

Products Affected

ailux

imx6

CWE

CWE-184

Incomplete List of Disallowed Inputs

NVD-CWE-noinfo

{"id": "CVE-2023-45593", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "prodsec@nozominetworks.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.9}]}, "published": "2024-03-05T12:15:46.213", "references": [{"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45593", "tags": ["Third Party Advisory"], "source": "prodsec@nozominetworks.com"}, {"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45593", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "prodsec@nozominetworks.com", "description": [{"lang": "en", "value": "CWE-184"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "A CWE-184 \u201cIncomplete List of Disallowed Inputs\u201d vulnerability in the embedded Chromium browser (concerning the handling of alternative URLs, other than \u201c http://localhost\u201d ) allows a physical attacker to read arbitrary files on the file system, alter the configuration of the embedded browser, and have other unspecified impacts to the confidentiality, integrity, and availability of the device. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2."}, {"lang": "es", "value": "Una vulnerabilidad CWE-693 de \u201cFallo del mecanismo de protecci\u00f3n\u201d en el navegador Chromium integrado (relacionada con el manejo de URL alternativas, distintas de \u201chttp://localhost\u201d http://localhost\u201d) permite a un atacante f\u00edsico leer archivos arbitrarios en el archivo sistema, alterar la configuraci\u00f3n del navegador integrado y tener otros impactos no especificados en la confidencialidad, integridad y disponibilidad del dispositivo. Este problema afecta: Paquete AiLux imx6 inferior a la versi\u00f3n imx6_1.0.7-2."}], "lastModified": "2025-04-10T20:24:58.750", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ailux:imx6:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0AC8BA0D-1588-4072-8BEA-464B1E76AF80", "versionEndExcluding": "1.0.7-2"}], "operator": "OR"}]}], "sourceIdentifier": "prodsec@nozominetworks.com"}