CVE-2023-0321
Critical
Description
Campbell Scientific dataloggers CR6, CR300, CR800, CR1000 and CR3000 may allow an attacker to download configuration files, which may contain sensitive information about the internal network. From factory defaults, the mentioned datalogges have HTTP and PakBus enabled. The devices, with the default configuration, allow this situation via the PakBus port. The exploitation of this vulnerability may allow an attacker to download, modify, and upload new configuration files.
SeverityCritical
CVSS9.1
Exploit probability—
ProductCampbellsci Cr300 Firmware
PublishedJan 26, 2023
First seenJan 26, 2023
Weakness typeCWE-200Sensitive information exposure
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| campbellsci cr300_firmware | No range specified | — |
| campbellsci cr6_firmware | No range specified | — |
| campbellsci cr800_firmware | No range specified | — |
| campbellsci cr1000_firmware | No range specified | — |
| campbellsci cr3000_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.