CVE-2023-28865
Published: 08 August 2024
Summary
CVE-2023-28865 is a medium-severity Insufficient Verification of Data Authenticity (CWE-345) vulnerability in Dieboldnixdorf Vynamic Security Suite. Its CVSS base score is 6.6 (Medium).
Operationally, ranked in the top 44.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-32486
Vulnerability details
Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR15, 4.0.0 SR05, 4.1.0 SR03, and 4.2.0 SR02 fails to validate the directory contents of certain directories (e.g., ensuring the expected hash sum) during the Pre-Boot Authorization (PBA) process. This can be…
more
exploited by a physical attacker who is able to manipulate the contents of the system's hard disk.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Mandates provision of authenticity and integrity artifacts that enable verification of name/address resolution data.
Control requires verification of data authenticity/integrity (e.g., checksums) after aggregation/packing, directly reducing exploitation of insufficient verification before transmission.
Directly supplies the missing integrity verification mechanism the weakness describes.
Provenance documentation and monitoring directly enables verification of authenticity for components and data throughout their history.
The control implements verification mechanisms that detect tampering by ensuring data authenticity.
Irrefutable evidence of actions requires integrity protection to prevent tampering or alteration of records.
Implements required signature-based integrity verification, addressing missing support for integrity checks on components.
Directly requires independent verification of matching output before adverse decisions, mitigating insufficient authenticity checks on data from external sources.