CVE-2023-2538

MediumCVSS 4.2/10Last modified Jun 17, 2026

Description

A CWE-552 "Files or Directories Accessible to External Parties” in the web interface of the Tyan S5552 BMC version 3.00 allows an unauthenticated remote attacker to retrieve the private key of the TLS certificate in use by the BMC via forced browsing. This can then be abused to perform Man-in-the-Middle (MitM) attacks against victims that access the web interface through HTTPS.

Metrics

CVSS 3.1 4.2/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-552

Affected software

Vendor	Product	Versions
tyan	s5552_bmc	3.00

References

https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-2538/Third Party Advisory
https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-2538/Third Party Advisory

Timeline

Published: Jul 5, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-253925.9Allegro Tech BigFlow <1.6 is vulnerable to Missing SSL Certificate Validation.CVE-2023-253947.0Videostream macOS app 0.5.0 and 0.4.3 has a Race Condition. The Updater privileged script attempts to update Videostream every 5 hours.CVE-2023-253959.8TOTOlink A7100RU V7.4cu.2313_B20191024 router was discovered to contain a command injection vulnerability via the ou parameter at /setting/d CVE-2023-253967.8Privilege escalation in the MSI repair functionality in Caphyon Advanced Installer 20.0 and below allows attackers to access and manipulate CVE-2023-253995.5A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function. Note: This CVE-2023-254027.5CleverStupidDog yf-exam 1.8.0 is vulnerable to File Upload. There is no restriction on the suffix of the uploaded file, resulting in any fil CVE-2023-254037.5CleverStupidDog yf-exam v 1.8.0 is vulnerable to Authentication Bypass. The program uses a fixed JWT key, and the stored key uses username f CVE-2023-254077.2Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. Restricted users have read access to administrator credentials.CVE-2023-254098.1Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. Restricted users have access to other users outlets.CVE-2023-25415.3The Web Frontend of KNIME Business Hub before 1.4.0 allows an unauthenticated remote attacker to access internals about the application such CVE-2023-254114.3Aten PE8108 2.4.232 is vulnerable to Cross Site Request Forgery (CSRF).CVE-2023-254137.5Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. The device allows unauthenticated access to Telnet and SNMP credentials.