Medium severity · published Sep 27, 2023
CVE-2023-43775
Denial-of-service vulnerability in the web server of the Eaton SMP Gateway allows attacker to potentially force an unexpected restart of the automation platform, impacting the…
5.3
CVSS
0.8%
EPSS
No
On KEV
Description
Denial-of-service vulnerability in the web server of the Eaton SMP Gateway allows
attacker to potentially force an unexpected restart of the automation platform, impacting the availability of the product. In rare situations, the issue could cause
the SMP device to restart in Safe Mode or Max Safe Mode. When in Max Safe Mode, the product is
not vulnerable anymore.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
S1
Smp 16 Firmware · Eaton
8.0 before 8.0r9; 6.3; 7.0; 7.1; 7.2 · source: NVD
S4
Smp 4/dp Firmware · Eaton
8.0 before 8.0r9; 8.1 before 8.1r5; 8.2 before 8.2r4; 6.3; 7.0; 7.1; +1 more · source: NVD
SS
Smp Sg-4250 Firmware · Eaton
8.0 before 8.0r9; 8.1 before 8.1r5; 8.2 before 8.2r4; 7.0; 7.1; 7.2 · source: NVD
SS
Smp Sg-4260 Firmware · Eaton
8.0 before 8.0r9; 8.1 before 8.1r5; 8.2 before 8.2r4 · source: NVD