CVE-2023-1552

CVSS V2 None CVSS V3 None

Description

ToolboxST prior to version 7.10 is affected by a deserialization vulnerability. An attacker with local access to an HMI or who has conducted a social engineering attack on an authorized operator could execute code in a Toolbox user's context through the deserialization of an untrusted configuration file. Two CVSS scores have been provided to capture the differences between the two aforementioned attack vectors. Customers are advised to update to ToolboxST 7.10 which can be found in ControlST 7.10. If unable to update at this time customers should ensure they are following the guidance laid out in GE Gas Power's Secure Deployment Guide (GEH-6839). Customers should ensure they are not running ToolboxST as an Administrative user.

Overview

CVE ID
CVE-2023-1552

Assigner
GEPowerCVD@ge.com

Vulnerability Status
Analyzed

Published Version
2023-04-11T15:15:10

Last Modified Date
2023-04-20T21:07:36

Weakness Enumerations

CWE	URL
CWE-502	http://cwe.mitre.org/data/definitions/502.html

CPE Configuration (Product)

CPE	Vulnerable	Operator	Version Start	Version End
cpe:2.3:a:ge:toolboxst::::::::	1	OR		7.10

References

Reference URL	Reference Tags
https://www.ge.com/content/dam/cyber_security/global/en_US/pdfs/2023-03-23_ToolboxST_Deserialization_of_Untrusted_Configuration_Data.pdf

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-1552
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1552

History

Created	Old Value	New Value	Data Type	Notes
2023-04-17 04:30:30				Added to TrackCVE
2023-04-17 17:00:38	Awaiting Analysis	Undergoing Analysis	Vulnerability Status	updated
2023-04-20 22:00:45		2023-04-20T21:07:36	CVE Modified Date	updated
2023-04-20 22:00:45	Undergoing Analysis	Analyzed	Vulnerability Status	updated
2023-04-20 22:00:47			Weakness Enumeration	new
2023-04-20 22:00:49			CPE Information	updated