CVE-2023-23590
high · 7.5Mercedes-Benz XENTRY Retail Data Storage 7.8.1 allows remote attackers to cause a denial of service (device restart) via an unauthenticated API request. The attacker must be on the same network as the device.
7.5
CVSS
26.4%
EPSS (exploit prob.)
98th
EPSS percentile
2023-01-15
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| mercedes-benz | xentry_retail_data_storage_firmware | 7.8.1 |
| mercedes-benz | xentry_retail_data_storage | all versions |
Check a specific version with /api/v1/cve/match.
References
- https://b2bconnect.mercedes-benz.com/gb/workshop-solutions/diagnosis/retail-data-storage
- https://medium.com/%40windsormoreira/xentry-retail-data-storage-v7-8-1-denial-of-service-cve-2023-23590-60b65f5fa358
- https://b2bconnect.mercedes-benz.com/gb/workshop-solutions/diagnosis/retail-data-storage
- https://medium.com/%40windsormoreira/xentry-retail-data-storage-v7-8-1-denial-of-service-cve-2023-23590-60b65f5fa358
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2023-23590