VULNERABILITY INTELLIGENCE
CVE-2023-0321
CVSS score9.1 CRITICAL
EPSS probability0.86%
CISA KEVNot currently listed
Published2023-01-26
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Description
Campbell Scientific dataloggers CR6, CR300, CR800, CR1000 and CR3000 may allow an attacker to download configuration files, which may contain sensitive information about the internal network. From factory defaults, the mentioned datalogges have HTTP and PakBus enabled. The devices, with the default configuration, allow this situation via the PakBus port. The exploitation of this vulnerability may allow an attacker to download, modify, and upload new configuration files.
Weakness classification
- cve-coordination@incibe.es: CWE-200
- nvd@nist.gov: CWE-200
Primary references
- cve-coordination@incibe.es — Exploit, Third Party Advisory
- cve-coordination@incibe.es — Mitigation, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Mitigation, Third Party Advisory