Cyber Resilience

CVE-2023-5702

Viessmann Vitogate 300 Firmware ≤ 2.1.3.0

Published
23 October 2023
Modified
21 November 2024
CVSS Score v3.1 4.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.15 96th percentile
Risk Priority 54 floored blend · peak EPSS

Summary

CVE-2023-5702 is a medium-severity Forced Browsing (CWE-425) vulnerability in Viessmann Vitogate 300 Firmware. Its CVSS base score is 4.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

A vulnerability exists in Viessmann Vitogate 300 versions up to 2.1.3.0 and is tracked as CVE-2023-5702. The issue affects an unspecified function within the /cgi-bin/ path and is caused by improper access control that permits direct requests, corresponding to CWE-425. The flaw carries a CVSS 3.1 base score of 4.3.

An unauthenticated attacker positioned on an adjacent network can send crafted requests to the affected endpoint and retrieve limited sensitive data. Public proof-of-concept material has been released, confirming that the attack requires no user interaction or elevated privileges.

The vendor was notified prior to disclosure but did not respond or issue a patch. Available references consist of third-party technical write-ups and vulnerability database entries that reproduce the request manipulation but provide no official mitigation guidance. The associated EPSS score reached a peak of 0.3545.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

A vulnerability was found in Viessmann Vitogate 300 up to 2.1.3.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /cgi-bin/. The manipulation leads to direct request. The exploit has been disclosed to the…

more

public and may be used. The identifier of this vulnerability is VDB-243140. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1083 File and Directory Discovery Discovery
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-45852Same product: Viessmann Vitogate 300
CVE-2023-5222Same product: Viessmann Vitogate 300
CVE-2023-1682Shared CWE-425
CVE-2024-7753Shared CWE-425
CVE-2025-27581Shared CWE-425
CVE-2025-52920Shared CWE-425
CVE-2024-0456Shared CWE-425
CVE-2026-34028Shared CWE-425
CVE-2023-44320Shared CWE-425
CVE-2023-3792Shared CWE-425

Affected Assets

viessmann
vitogate 300 firmware
≤ 2.1.3.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-425

Forcing a decision on every access request, including direct ones, reduces the exploitability of forced browsing by ensuring no unchecked access paths.

addresses: CWE-425

Forces all accesses through the reference monitor, preventing direct or forced requests that bypass checks.

addresses: CWE-425

Enforcing access for all logical requests prevents unauthorized direct access to protected resources.

addresses: CWE-425

Displaying the notification before further access on public systems prevents direct resource requests from bypassing the required system use terms and consent.

addresses: CWE-425

Decoy endpoints catch forced browsing and direct requests, deflecting attackers from legitimate resources while enabling analysis.

addresses: CWE-425

Blocks unauthorized direct requests or forced browsing by denying input access to non-authorized actors.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 full match
prevents

Directly requires policy-driven definition, enforcement, and review of authorizations on resources such as URLs.

PR.IR-01 mostly match
prevents

Protects environments from unauthorized logical access, which includes preventing direct requests to restricted paths.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing can detect forced-browsing flaws, but the control itself does not prevent them in production.

prevents

Information access restriction implements the technical enforcement that directly blocks unauthorized direct requests.

prevents

Access control policy directly requires authorization checks on all resources, preventing forced browsing.

degrades

Managing access rights ensures every URL/script/file is explicitly authorized, mitigating direct request attacks.

degrades

Privileged access rights control enforces least-privilege checks on restricted endpoints.

prevents

Secure SDLC can include authorization design, yet the control itself does not guarantee runtime enforcement.

References