CVE-2023-0321 Disclosure of Sensitive Information on Campbell Scientific Products
Attackers can download, modify, and upload configuration files on Campbell Scientific dataloggers via the default PakBus port, exposing sensitive network information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-0321?
CVE-2023-0321 is a critical vulnerability in Campbell Scientific CR1000, published on 25 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Campbell Scientific dataloggers CR6, CR300, CR800, CR1000 and CR3000 may allow an attacker to download configuration files, which may contain sensitive information about the internal network. From factory defaults, the mentioned datalogges have HTTP and PakBus enabled. The devices, with the default configuration, allow this situation via the PakBus port. The exploitation of this vulnerability may allow an attacker to download, modify, and upload new configuration files.
Weakness: CWE-200
Which versions are affected by CVE-2023-0321?
It affects 5 products.
Products include Campbellsci Cr1000 Firmware, Campbellsci Cr3000 Firmware, Campbellsci Cr300 Firmware, Campbellsci Cr6 Firmware, Campbellsci Cr800 Firmware.
How do I fix CVE-2023-0321?
No fix has been published for CVE-2023-0321 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-0321 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-0321 exists.
Sources
Also known as GHSA-4wqr-g68x-cv52.