Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2023-28616

Quick assessment

Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Stormshield Network Security是法国Stormshield公司的一款下一代UTM（统一威胁管理）防火墙。 Stormshield Network Security (SNS) 4.3.17 之前、4.6.4 之前、4.7.1 之前版本存在安全漏洞，该漏洞源于serverd 进程以明文形式记录具有等号或空格字符的用户帐户密码，并可能将这些日志发送到 Syslog 组件。

AI Predicted 5.3 Difficulty: Moderate EPSS 0.29% · P22

Possible ATT&CK Techniques 1 AI

T1552.004 · Private Keys
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2023-28616

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
An issue was discovered in Stormshield Network Security (SNS) before 4.3.17, 4.4.x through 4.6.x before 4.6.4, and 4.7.x before 4.7.1. It affects user accounts for which the password has an equals sign or space character. The serverd process logs such passwords in cleartext, and potentially sends these logs to the Syslog component.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Stormshield Network Security 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Stormshield Network Security是法国Stormshield公司的一款下一代UTM（统一威胁管理）防火墙。 Stormshield Network Security (SNS) 4.3.17 之前、4.6.4 之前、4.7.1 之前版本存在安全漏洞，该漏洞源于serverd 进程以明文形式记录具有等号或空格字符的用户帐户密码，并可能将这些日志发送到 Syslog 组件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
- n/a n/a -

II. Public POCs for CVE-2023-28616

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-28616

请登录查看更多情报信息。

Other References for CVE-2023-28616 (1)

Same Patch Batch · n/a · 2023-12-26 · 25 CVEs total

CVE-2015-10127 3.5 LOW PlusCaptcha Plugin cross site scripting
CVE-2023-51098 Tenda W9 安全漏洞
CVE-2023-52096 ocpp-jaxb 安全漏洞
CVE-2023-52086 resumable.php 安全漏洞
CVE-2023-51107 MuPDF 安全漏洞
CVE-2023-51106 MuPDF 安全漏洞
CVE-2023-51105 MuPDF 安全漏洞
CVE-2023-51104 MuPDF 安全漏洞
CVE-2023-51103 MuPDF 安全漏洞
CVE-2023-51102 Tenda W9 安全漏洞
CVE-2023-51101 Tenda W9 安全漏洞
CVE-2023-51100 Tenda W9 安全漏洞
CVE-2023-51099 Tenda W9 安全漏洞
CVE-2023-51097 Tenda W9 安全漏洞
CVE-2023-51095 Tenda M3 安全漏洞
CVE-2023-51094 Tenda M3 安全漏洞
CVE-2023-51093 Tenda M3 安全漏洞
CVE-2023-51092 Tenda M3 安全漏洞
CVE-2023-51091 Tenda M3 安全漏洞
CVE-2023-51090 Tenda M3 安全漏洞

Showing top 20 of 25 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: n/a
Same vendor: n/a

V. Comments for CVE-2023-28616

No comments yet

Leave a comment