Cyber Resilience

CVE-2023-0839

Inscada Project Inscada ≤ 20230115-1

Published
06 March 2023
Modified
01 June 2026
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0065 48th percentile
Risk Priority 72 floored blend · peak EPSS

Summary

CVE-2023-0839 is a critical-severity Improper Protection for Outbound Error Messages and Alert Signals (CWE-1320) vulnerability in Inscada Project Inscada. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Indicator Removal (T1070); ranked at the 48th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

Improper Protection for Outbound Error Messages and Alert Signals vulnerability in ProMIS Process Co. InSCADA allows Account Footprinting. This issue affects inSCADA: before 20230115-1.

CWE(s)
CWE-1320NVD-CWE-Other

Related Threats

MITRE ATT&CK Enterprise Techniques

T1070 Indicator Removal Stealth
Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity.
attack.mitre.org →
T1564 Hide Artifacts Stealth
Adversaries may attempt to hide artifacts associated with their behaviors to evade detection.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-5635Shared CWE-1320
CVE-2023-1014Shared CWE-1320
CVE-2023-5443Shared CWE-1320
CVE-2023-5570Shared CWE-1320

Affected Assets

inscada project
inscada
≤ 20230115-1

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

DE.AE-06 partial match
prevents

Ensuring adverse-event information reaches only authorized recipients implies safeguards against suppression or tampering of alerts.

PR.AA-05 partial match
prevents

Least-privilege access policies limit which agents can modify or disable alert-generation mechanisms.

PR.IR-01 partial match
prevents

Network and environment protections block unauthorized agents from reaching and tampering with outbound alert paths.

PR.PS-04 partial match
prevents

Requiring protected, continuously monitored log and alert records directly counters the ability to silently disable them.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can verify that alerts and signals cannot be disabled by untrusted agents.

A.8.15 Logging partial match
degrades

Logging of error and alert signals supports detection of tampering or suppression.

A.8.16 Monitoring activities partial match
finds

Monitoring activities can detect disabled or suppressed outbound alerts.

A.8.25 Secure development life cycle partial match
prevents

Secure development lifecycle includes requirements for proper error and alert handling.

A.8.26 Application security requirements partial match
prevents

Application security requirements can mandate protection of outbound alerts and signals.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles address integrity of error and alert mechanisms.

References