CVE-2023-28865

Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR15, 4.0.0 SR05, 4.1.0 SR03, and 4.2.0 SR02 fails to validate the directory contents of certain directories (e.g., ensuring the expected hash sum) during the Pre-Boot Authorization (PBA) process. This can be exploited by a physical attacker who is able to manipulate the contents of the system's hard disk.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.6 MEDIUM
PHYSICAL
LOW
LOW
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CISA-ADPADP
6.6 MEDIUM
PHYSICAL
LOW
LOW
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 9%
VendorProductVersion
dieboldnixdorfvynamic_security_suite
𝑥
< 3.3.0sr15
dieboldnixdorfvynamic_security_suite
4.0.0 ≤
𝑥
< 4.0.0sr05
dieboldnixdorfvynamic_security_suite
4.1.0 ≤
𝑥
< 4.1.0sr03
dieboldnixdorfvynamic_security_suite
4.2.0 ≤
𝑥
< 4.2.0sr02
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Matt%20Burch%20-%20Where%E2%80%99s%20the%20Money%20-%20Defeating%20ATM%20Disk%20Encryption-white%20paper.pdf
https://www.dieboldnixdorf.com/en-us/banking/portfolio/software/security/