CVE-2023-24503 - Vulnerability Details - OpenCVE

ReportizFlow

Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Electra-air	Smart Kit For Split Ac

Configuration 1 [-]

cpe:2.3:a:electra-air:smart_kit_for_split_ac:osk201:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.gov.il/en/Departments/faq/cve_advisories

History

Thu, 06 Feb 2025 16:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-494
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: INCD

Published: 2023-04-17T00:00:00.000Z

Updated: 2025-02-06T15:18:56.447Z

Reserved: 2023-01-24T00:00:00.000Z

Link: CVE-2023-24503

Vulnrichment

Updated: 2024-08-02T10:56:04.348Z

NVD

Status : Modified

Published: 2023-04-17T22:15:08.220

Modified: 2025-02-06T16:15:33.780

Link: CVE-2023-24503

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-24503", "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "assignerShortName": "INCD", "dateUpdated": "2025-02-06T15:18:56.447Z", "dateReserved": "2023-01-24T00:00:00.000Z", "datePublished": "2023-04-17T00:00:00.000Z"}, "containers": {"cna": {"title": " Electra Smart Kit for Split AC \u2013 Adjacent attacker may cause the unit to load unauthorized FW", "datePublic": "2023-04-17T00:00:00.000Z", "providerMetadata": {"orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "shortName": "INCD", "dateUpdated": "2023-04-17T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "Electra Central AC unit \u2013 Adjacent attacker may cause the unit to load unauthorized FW."}], "affected": [{"vendor": "Electra", "product": "OSK201", "versions": [{"version": "Update to the latest version", "status": "affected", "lessThan": "Update to the latest version*", "versionType": "custom"}]}], "references": [{"url": "https://www.gov.il/en/Departments/faq/cve_advisories"}], "credits": [{"lang": "en", "value": "Lev Aronsky, Idan Strovinsky"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "Adjacent attacker may cause the unit to load unauthorized FW"}]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "source": {"defect": ["ILVN-2023-0090"], "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:56:04.348Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.gov.il/en/Departments/faq/cve_advisories", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-494", "lang": "en", "description": "CWE-494 Download of Code Without Integrity Check"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-06T15:17:49.550387Z", "id": "CVE-2023-24503", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-06T15:18:56.447Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.gov.il/en/Departments/faq/cve_advisories", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:56:04.348Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-24503", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-06T15:17:49.550387Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-494", "description": "CWE-494 Download of Code Without Integrity Check"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-06T15:18:40.167Z"}}], "cna": {"title": " Electra Smart Kit for Split AC \u2013 Adjacent attacker may cause the unit to load unauthorized FW", "source": {"defect": ["ILVN-2023-0090"], "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "value": "Lev Aronsky, Idan Strovinsky"}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Electra", "product": "OSK201", "versions": [{"status": "affected", "version": "Update to the latest version", "lessThan": "Update to the latest version*", "versionType": "custom"}]}], "datePublic": "2023-04-17T00:00:00.000Z", "references": [{"url": "https://www.gov.il/en/Departments/faq/cve_advisories"}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "descriptions": [{"lang": "en", "value": "Electra Central AC unit \u2013 Adjacent attacker may cause the unit to load unauthorized FW."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Adjacent attacker may cause the unit to load unauthorized FW"}]}], "providerMetadata": {"orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "shortName": "INCD", "dateUpdated": "2023-04-17T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2023-24503", "state": "PUBLISHED", "dateUpdated": "2025-02-06T15:18:56.447Z", "dateReserved": "2023-01-24T00:00:00.000Z", "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "datePublished": "2023-04-17T00:00:00.000Z", "assignerShortName": "INCD"}, "dataVersion": "5.1"}