CVE-2023-7343

HighPublic PoCLPE

Published: 02 April 2026

Published

02 April 2026

Modified

26 May 2026

KEV Added

—

Patch

—

CVSS Score v4 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0014 3.8th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2023-7343 is a high-severity Improper Privilege Management (CWE-269) vulnerability. Its CVSS base score is 8.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 3.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2023-7343 is a privilege escalation vulnerability (CWE-269) in the HiSecOS web server, affecting versions 05.0.00 through 08.3.01 prior to 08.3.02. The flaw allows authenticated users to elevate their privileges by sending specially crafted packets to the web server, with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

Authenticated users holding operator or auditor roles can exploit this vulnerability to escalate their privileges to the administrator role, thereby gaining full administrative access to the affected device.

The Belden Security Bulletin BSECV-2023-06, available at https://assets.belden.com/m/774e2db2b0100bc1/original/Belden-Security-Bulletin-BSECV-2023-06.pdf, along with the VulnCheck advisory at https://www.vulncheck.com/advisories/belden-industrial-hivision-arbitrary-code-execution-via-malicious-project-file, provide details on mitigation, which includes updating the HiSecOS web server to version 08.3.02 or later.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2023-60547

Vulnerability details

Hirschmann Industrial HiVision versions 05.0.00 through 08.3.01 prior to 08.3.02 contain an arbitrary code execution vulnerability triggered when an administrator opens a maliciously crafted project file. Successful exploitation allows the attacker to execute code in the context of the HiVision…

process.

CWE(s): CWE-269

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

The CVE describes a privilege escalation flaw exploitable by authenticated lower-privileged users via crafted input to the web server, directly matching Exploitation for Privilege Escalation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0