CVE-2023-33206
EUVD-2023-3737608.08.2024, 18:15
Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR16, 4.0.0 SR06, 4.1.0 SR04, 4.2.0 SR03, and 4.3.0 SR01 fails to validate symlinks during the Pre-Boot Authorization (PBA) process. This can be exploited by a physical attacker who is able to manipulate the contents of the system's hard disk.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| dieboldnixdorf | vynamic_security_suite | 𝑥 < 3.3.0sr16 |
| dieboldnixdorf | vynamic_security_suite | 4.0.0 ≤ 𝑥 < 4.0.0sr06 |
| dieboldnixdorf | vynamic_security_suite | 4.1.0 ≤ 𝑥 < 4.1.0sr04 |
| dieboldnixdorf | vynamic_security_suite | 4.2.0 ≤ 𝑥 < 4.2.0sr03 |
| dieboldnixdorf | vynamic_security_suite | 4.3.0 ≤ 𝑥 < 4.3.0sr01 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-354 - Improper Validation of Integrity Check ValueThe software does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.
- CWE-94 - Improper Control of Generation of Code ('Code Injection')The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.