CVE-2023-1514

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability exists in the component RTU500 Scripting interface. When a client connects to a server using TLS, the server presents a certificate. This certificate links a public key to the identity of the service and is signed by a Certification Authority (CA), allowing the client to validate that the remote service can be trusted and is not malicious. If the client does not validate the parameters of the certificate, then attackers could be able to spoof the identity of the service. An attacker could exploit the vulnerability by using faking the identity of a RTU500 device and intercepting the messages initiated via the RTU500 Scripting interface.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published
Dec 19, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-15155.4Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.CVE-2023-15167.8RoboDK versions 5.5.3 and prior contain an insecure permission assignment to critical directories vulnerability, which could allow a localCVE-2023-15174.8Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.19.CVE-2023-15187.5CP Plus KVMS Pro versions 2.01.0.T.190521 and prior are vulnerable to sensitive credentials being leaked because they are insufficiently pCVE-2023-15217.8On Linux the sccache client can execute arbitrary code with the privileges of a local sccache server, by preloading the code in a shared libCVE-2023-15228.8SQL Injection in the Hardware Inventory report of Security Center 5.11.2.CVE-2023-152310.0Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it toCVE-2023-15246.5The Download Manager WordPress plugin before 3.2.71 does not adequately validate passwords for password-protected files. Upon validation, a CVE-2023-15254.8The Site Reviews WordPress plugin before 6.7.1 does not sanitise and escape some of its settings, which could allow high privilege users sucCVE-2023-15264.6Certain DesignJet and PageWide XL TAA compliant models may have risk of potential information disclosure if the hard disk drive is physicallCVE-2023-15275.4Cross-site Scripting (XSS) - Generic in GitHub repository tsolucio/corebos prior to 8.0.CVE-2023-15288.8Use after free in Passwords in Google Chrome prior to 111.0.5563.110 allowed a remote attacker who had compromised the renderer process to p