Resource exhaustion in Eaton Smp 16
CVE-2023-43775
Denial-of-service vulnerability in the web server of the Eaton SMP Gateway allows attacker to potentially force an unexpected restart of the automation platform, impacting the availability of the product. In rare situations, the issue could cause the SMP device to restart in Safe Mode or Max Safe Mode. When in Max Safe Mode, the product is not vulnerable anymore.
Vulnerability class: DoS (Denial of Service)
EPSS: 0.007 (48.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.7 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L.
Affected products
- Eaton Smp 16 — versions 6.3, 7.0, 7.1
- Eaton Smp_16
- Eaton Smp_16_firmware — versions 6.3, 7.0, 7.1
- Eaton Smp 4/dp — versions 6.3, 7.0, 7.1
- Eaton Smp_4\/dp
- Eaton Smp_4\/dp_firmware — versions 6.3, 7.0, 7.1
- Eaton Smp Sg-4250 — versions 7.0, 7.1, 7.2
- Eaton Smp_sg-4250
- Eaton Smp_sg-4250_firmware — versions 7.0, 7.1, 7.2
- Eaton Smp Sg-4260 — versions 8.0, 8.1, 8.2
Weakness classification (CWE)
References
- CybersecurityCOE@eaton.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-43775?
- CVE-2023-43775 is a medium-severity vulnerability in Eaton Smp 16, classified under Uncontrolled Resource Consumption. CVSS score: 4.7/10. Published 2023-09-27.
- How severe is CVE-2023-43775?
- Medium severity. CVSS v3 base score is 4.7 out of 10.