VulnerabilityDeferred

CVE-2023-37482

An unauthenticated remote attacker could exploit this side-channel information to distinguish between valid and invalid usernames.

MEDIUM 6.9EPSS 0.51%

Does this matter?

Lower severity and a low EPSS score (0.51%). Track it; it rarely justifies an emergency change on its own.

Description

The login functionality of the web server in affected devices does not normalize the response times of login attempts. An unauthenticated remote attacker could exploit this side-channel information to distinguish between valid and invalid usernames.

CVSS 4.0: 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.51% probability · 42th percentile
CISA KEV: Not listed
Weakness: CWE-203
Source: productcert@siemens.com

References

https://cert-portal.siemens.com/productcert/html/ssa-195895.html

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.