CVE-2023-36857

Published: Oct 19, 2023Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 3.9 / Impact: 2.5

Source: NVD

Description

Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a replay vulnerability which could allow an attacker to replay older captured packets of traffic to the device to gain access.

Affected (1)

Products: Bakerhughes: Bentley Nevada 3500 System Firmware

Bakerhughes

1 product

Bentley Nevada 3500 System Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Bakerhughes Bentley Nevada 3500 System Firmware	Version 5.0.5

Running on/with	Platform Versions
Bakerhughes Bentley Nevada 3500 System	All versions

Related CWEs

CWE-294

Authentication Bypass by Capture-replay

A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

References (2)

https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-05

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryUS Government Resource

https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-05

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.