CVE-2023-2187

On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send broadcast events to any user via the WebMonitor.An unauthenticated user can use this vulnerability to forcefully log out of any currently logged-in user by sending a "password change event". Furthermore, an attacker could use this vulnerability to spam the logged-in user with false events.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://www.trellix.com/en-us/about/newsroom/stories/research/industrial-and-manufacturing-cves.html	Third Party Advisory
https://www.trellix.com/en-us/about/newsroom/stories/research/industrial-and-manufacturing-cves.html	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:trianglemicroworks:scada_data_gateway:*:*:*:*:*:*:*:*

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) En la versión menor o igual a v5.01.03 de SCADA Data Gateway de Triangle MicroWorks, un atacante no autenticado puede enviar eventos de difusión a cualquier usuario a través del WebMonitor. Un usuario no autenticado puede usar esta vulnerabilidad para cerrar la sesión forzosamente de cualquier usuario actualmente conectado enviando un 'evento de cambio de contraseña'. Además, un atacante podría usar esta vulnerabilidad para enviar correo no deseado al usuario conectado con eventos falsos.

Information

Published : 2023-06-07 07:15

Updated : 2026-10-23 23:10

NVD link : CVE-2023-2187

Mitre link : CVE-2023-2187

CVE.ORG link : CVE-2023-2187

JSON object : View

Products Affected

trianglemicroworks

scada_data_gateway

CWE

CWE-306

Missing Authentication for Critical Function

NVD-CWE-noinfo

{"id": "CVE-2023-2187", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-2187", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-06T21:08:33.609789Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "trellixpsirt@trellix.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "trellixpsirt@trellix.com", "affectedData": [{"vendor": "Triangle MicroWorks", "product": "SCADA Data Gateway", "versions": [{"status": "affected", "version": "5.01.03"}], "defaultStatus": "unaffected"}]}], "published": "2023-06-07T07:15:08.740", "references": [{"url": "https://www.trellix.com/en-us/about/newsroom/stories/research/industrial-and-manufacturing-cves.html", "tags": ["Third Party Advisory"], "source": "trellixpsirt@trellix.com"}, {"url": "https://www.trellix.com/en-us/about/newsroom/stories/research/industrial-and-manufacturing-cves.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "trellixpsirt@trellix.com", "description": [{"lang": "en", "value": "CWE-306"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send broadcast events to any user via the WebMonitor.An unauthenticated user can use this vulnerability to forcefully log out of any currently logged-in user by sending a \"password change event\". Furthermore, an attacker could use this vulnerability to spam the logged-in user with false events."}, {"lang": "es", "value": "En la versi\u00f3n menor o igual a v5.01.03 de SCADA Data Gateway de Triangle MicroWorks, un atacante no autenticado puede enviar eventos de difusi\u00f3n a cualquier usuario a trav\u00e9s del WebMonitor. Un usuario no autenticado puede usar esta vulnerabilidad para cerrar la sesi\u00f3n forzosamente de cualquier usuario actualmente conectado enviando un 'evento de cambio de contrase\u00f1a'. Adem\u00e1s, un atacante podr\u00eda usar esta vulnerabilidad para enviar correo no deseado al usuario conectado con eventos falsos."}], "lastModified": "2026-10-23T23:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:trianglemicroworks:scada_data_gateway:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A763593D-AA02-4DF7-9D24-A88EB254594D", "versionEndIncluding": "5.01.03"}], "operator": "OR"}]}], "sourceIdentifier": "trellixpsirt@trellix.com"}