CVE-2023-34437
Info Disclosure in Bakerhughes Bentley Nevada 3500 System Firmware 5.0.5
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2023-34437 is a high-severity Incorrect Permission Assignment for Critical Resource (CWE-732) vulnerability in Bakerhughes Bentley Nevada 3500 System Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Credentials In Files (T1552.001); ranked at the 38th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-38513
Vulnerability Data
Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a vulnerability in their password retrieval functionality which could allow an attacker to access passwords stored on the device.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 14 hardening rules · 7 OS baselines
V10.4.9V11.7.1V14.1.2V14.2.4
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Proper attribute retention and permitted-value enforcement limits unauthorized actors from accessing sensitive information lacking correct labels.
Audit logs and logging tools are critical resources whose protection requires correct permission assignments to block unauthorized actions.
Documenting information locations and authorized users enables better protection against unauthorized exposure of sensitive data.
Places configuration items under formal management, enforcing correct permission assignments on critical resources.
Requiring equivalent controls at the alternate storage site prevents unauthorized exposure of sensitive backup data.
Protecting confidentiality of backup information prevents unauthorized exposure of sensitive data stored in backups.
Assessing control effectiveness and providing incident communication channels at alternate sites reduces the likelihood of sensitive information exposure to unauthorized actors.
Requiring protection of the program plan from unauthorized disclosure directly reduces exposure of sensitive security program details and control descriptions.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Directly requires defining, enforcing, and reviewing access permissions and least privilege on resources.
PR.DS-10 mostly prevents CWE-200 by directly eliminating unauthorized access to sensitive data-in-use, yet only partially addresses the weakness because CWE-200 spans many other exposure vectors outside runtime protection.
PR.IR-01's segmentation/zero-trust controls largely eliminate network-level unauthorized access paths that enable exposure, yet CWE-200 spans many additional vectors (API responses, logs, app logic) that network controls alone cannot close.
Hardened baselines and configuration management explicitly include correct permission settings for critical resources.
Secure SDLC practices catch most exposure flaws via design, testing and release controls, yet CWE-200 spans runtime/config issues a single development outcome cannot fully close.
PR.AA-01 supplies proper credential lifecycle controls that reduce unauthorized access paths, yet leaves many other exposure vectors (error messages, logging, side channels, etc.) unaddressed.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Restricting anonymous or unknown access and encrypting high-value information limits the exposure of sensitive data that would otherwise be obtainable by unauthorized actors.
Suppressing system details, error specifics, and previous log-on information until successful authentication reduces the information an unauthenticated attacker can gather.
By requiring owners to assign sensitivity labels and corresponding handling rules, the control ensures that information is not left unmarked and therefore reduces the chance that sensitive data will be exposed to unauthorized actors.
Requiring encryption, access controls, and recipient authentication for transfers directly reduces the chance that sensitive data reaches an unauthorized observer.
By requiring owners to determine and document the exact permissions needed for each asset, the control reduces the likelihood that default or overly permissive file and resource permissions will be left in place.
Secure delivery, protected storage, and confidentiality of allocation records limit exposure of authentication material to unauthorized observers.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (1 rule)
- V-248577 OL 8 must enable kernel parameters to enforce Discretionary Access Control (DAC) on symlinks. prevents CWE-732
Ubuntu 22.04 (1 rule)
- V-260470 Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and maintenance modes. prevents CWE-200
Ubuntu 24.04 (2 rules)
- V-270647 Ubuntu 24.04 LTS must not have the telnet package installed. prevents CWE-200
- V-270675 Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes. prevents CWE-200
Windows 10 (1 rule)
- V-220737 Administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email. prevents CWE-200
Windows Server 2016 (3 rules)
- V-224972 Active Directory Group Policy objects must have proper access control permissions. prevents CWE-732
- V-224974 Domain-created Active Directory Organizational Unit (OU) objects must have proper access control permissions. prevents CWE-200
- V-224831 Local volumes must use a format that supports NTFS attributes. prevents CWE-732
Windows Server 2019 (3 rules)
- V-205741 Windows Server 2019 Active Directory Group Policy objects must have proper access control permissions. prevents CWE-732
- V-205743 Windows Server 2019 organization created Active Directory Organizational Unit (OU) objects must have proper access control permissions. prevents CWE-200
- V-205663 Windows Server 2019 local volumes must use a format that supports NTFS attributes. prevents CWE-732
Windows Server 2022 (3 rules)
- V-254393 Windows Server 2022 Active Directory Group Policy objects must have proper access control permissions. prevents CWE-732
- V-254395 Windows Server 2022 organization created Active Directory Organizational Unit (OU) objects must have proper access control permissions. prevents CWE-200
- V-254250 Windows Server 2022 local volumes must use a format that supports NTFS attributes. prevents CWE-732