CVE-2023-39172 - OpenCVE

The affected devices transmit sensitive information unencrypted allowing a remote unauthenticated attacker to capture and modify network traffic.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Enbw	Senec Storage Box Senec Storage Box Firmware

Configuration 1 [-]

AND

cpe:2.3:o:enbw:senec_storage_box_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:enbw:senec_storage_box:v1:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:enbw:senec_storage_box_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:enbw:senec_storage_box:v2:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:enbw:senec_storage_box_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:enbw:senec_storage_box:v3:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://seclists.org/fulldisclosure/2023/Nov/4
https://seclists.org/fulldisclosure/2023/Nov/4

History

Tue, 04 Nov 2025 20:30:00 +0000

Type	Values Removed	Values Added
References		http://seclists.org/fulldisclosure/2023/Nov/4

MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published: 2023-12-07T13:58:56.198Z

Updated: 2025-11-04T19:17:41.037Z

Reserved: 2023-07-25T14:06:01.345Z

Link: CVE-2023-39172

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-12-07T14:15:07.883

Modified: 2025-11-04T20:16:35.803

Link: CVE-2023-39172

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-39172", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "state": "PUBLISHED", "assignerShortName": "CERTVDE", "dateReserved": "2023-07-25T14:06:01.345Z", "datePublished": "2023-12-07T13:58:56.198Z", "dateUpdated": "2025-11-04T19:17:41.037Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Storage Box V1", "vendor": "SENEC", "versions": [{"status": "affected", "version": "V1"}]}, {"defaultStatus": "unaffected", "product": "Storage Box V2", "vendor": "SENEC", "versions": [{"status": "affected", "version": "V2"}]}, {"defaultStatus": "unaffected", "product": "Storage Box V3", "vendor": "SENEC", "versions": [{"status": "affected", "version": "V3"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Ph0s[4]"}, {"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "R0ckE7"}], "datePublic": "2023-12-07T14:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The affected devices transmit sensitive information unencrypted allowing a remote unauthenticated attacker to capture and modify network traffic."}], "value": "The affected devices transmit sensitive information unencrypted allowing a remote unauthenticated attacker to capture and modify network traffic."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-319", "description": "CWE-319 Cleartext Transmission of Sensitive Information", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2023-12-07T14:00:24.457Z"}, "references": [{"url": "https://seclists.org/fulldisclosure/2023/Nov/4"}], "source": {"defect": ["CERT@VDE#64567"], "discovery": "UNKNOWN"}, "title": "SENEC: Storage Box V1,V2 and V3 transmitting sensitive data unencrypted", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://seclists.org/fulldisclosure/2023/Nov/4", "tags": ["x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2023/Nov/4"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T19:17:41.037Z"}}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:enbw:senec_storage_box_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "AF2C3F5B-266D-455B-944D-9EDBB0268439", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:enbw:senec_storage_box:v1:*:*:*:*:*:*:*", "matchCriteriaId": "1A73E447-D78F-420B-B256-1F157A6DA364", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:enbw:senec_storage_box_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "AF2C3F5B-266D-455B-944D-9EDBB0268439", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:enbw:senec_storage_box:v2:*:*:*:*:*:*:*", "matchCriteriaId": "300B219B-45CA-44C0-AC39-D94057FA8860", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:enbw:senec_storage_box_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "AF2C3F5B-266D-455B-944D-9EDBB0268439", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:enbw:senec_storage_box:v3:*:*:*:*:*:*:*", "matchCriteriaId": "449C542C-CAE3-42A9-BF45-EE6E828A4EBE", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The affected devices transmit sensitive information unencrypted allowing a remote unauthenticated attacker to capture and modify network traffic."}, {"lang": "es", "value": "Los dispositivos afectados transmiten informaci\u00f3n confidencial sin cifrar, lo que permite a un atacante remoto no autenticado capturar y modificar el tr\u00e1fico de la red."}], "id": "CVE-2023-39172", "lastModified": "2025-11-04T20:16:35.803", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "[email protected]", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "[email protected]", "type": "Primary"}]}, "published": "2023-12-07T14:15:07.883", "references": [{"source": "[email protected]", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://seclists.org/fulldisclosure/2023/Nov/4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2023/Nov/4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://seclists.org/fulldisclosure/2023/Nov/4"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-319"}], "source": "[email protected]", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-319"}], "source": "[email protected]", "type": "Primary"}]}