Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-50934 is a medium-severity Use of Single-factor Authentication (CWE-308) vulnerability in Ibm Powersc. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Remote Services (T1021); ranked at the 37th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-2 (Identification and Authentication (Organizational Users)) and IA-3 (Device Identification and Authentication) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-55665
Vulnerability Data
IBM PowerSC 1.3, 2.0, and 2.1 uses single-factor authentication which can lead to unnecessary risk of compromise when compared with the benefits of a dual-factor authentication scheme. IBM X-Force ID: 275114.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V6.3.4V6.3.6V6.4.2V6.4.3
Mitigating Controls (NIST 800-53 r5) AI
ia-2 requires unique identification and authentication of users, directly stopping single-factor schemes by mandating appropriate (multi-factor) mechanisms.
Requires unique identification and authentication of devices before establishing connections, preventing unauthenticated device claims.
ia-8 requires unique identification and authentication of non-organizational users, directly stopping single-factor schemes by mandating appropriate (multi-factor) mechanisms.
Manages authenticators with verification and secure distribution, reducing opportunities for improper authentication.
Enforces access only after approved authorizations, which presupposes correct authentication has occurred.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Explicit MFA requirement directly eliminates single-factor authentication while the control also addresses broader authentication scope.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.15 only requires defining and documenting an access control policy plus requirements (including references to other controls); it performs no authentication enforcement or multi-factor mandate that would stop single-factor authentication from being exploitable.
Mandating segregated approval and oversight for non-human identities reduces the chance that weak or orphaned credentials can be exploited for unauthorized authentication.
Authentication information control directly addresses the need for strong, multi-factor credentials.
Access rights provisioning can require MFA, yet the control is broader than authentication strength.
Privileged access rights can be conditioned on MFA, but the control focuses on privilege scope rather than factor count.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.