PolyEco1000: Session Fixation
CVE-2023-0897 is a critical-severity session fixation vulnerability in PolyEco1000 from Sielco, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected PolyEco1000 versions: CPU:2.0.6 FPGA:10.19; CPU:1.9.4 FPGA:10.19; CPU:1.9.3 FPGA:10.19, and others listed below. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.57% chance of exploitation within 30 days, which is low compared with other CVEs.
Critical severity: a successful attack would have severe impact.
What to do
- Check which version of PolyEco1000 you run against the affected versions below, and install the vendor's latest release.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Sielco | PolyEco1000 | CPU:2.0.6 FPGA:10.19; CPU:1.9.4 FPGA:10.19; CPU:1.9.3 FPGA:10.19; CPU:1.7.0 FPGA:10.16; CPU:2.0.2 FPGA:10.19; CPU:2.0.0 FPGA:10.19 | Not stated |
| Sielco | Polyeco500 Firmware | 1.7.0; 10.16 | Not stated |
| Sielco | Polyeco300 Firmware | 2.0.0; 2.0.2; 10.19 | Not stated |
| Sielco | Polyeco1000 Firmware | 1.9.3; 1.9.4; 2.0.6; 10.19 | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 8.8 | High | CNA (hq.dhs.gov) |
| CVSS 3.1 | 9.8 | Critical | NVD |
Official description
Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session being visible in requests.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
How developers prevent this class of flaw
- Invalidate any existing session identifiers prior to authorizing a new user session.
- For platforms such as ASP that do not generate new values for sessionid cookies, utilize a secondary cookie. In this approach, set a secondary cookie on the user's browser to a random value and set a session variable to the same value. If the session variable and the cookie value ever don't match, invalidate the session, and force the user to log on again.
- Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Third-party and government advisories
- cisa.gov/news-events/ics-advisories/icsa-23-299-07Third Party Advisory, US Government Resource
Other vulnerabilities in PolyEco1000
- 9.8 Critical severity
- 9.1 Critical severity
- 8.1 High severity
- 9.8 Critical severity
- 7.5 High severity
Recent Session Fixation vulnerabilities
- 8.8 High severity
- 7.8 High severity
- 8.8 High severity
- 9.8 Critical severity
- 8.0 High severity
- 7.0 High severity
Spotted an error? Tell us.