CVE-2023-4523 : Security Advisory and Response

This CVE-2023-4523 was assigned by icscert and was published on September 27, 2023. The vulnerability affects Real Time Automation's 460 Series products with versions prior to v8.9.8, making them susceptible to cross-site scripting.

Understanding CVE-2023-4523

This vulnerability in Real Time Automation’s 460 Series products poses a critical risk as it allows attackers to execute JavaScript code from the URL string, potentially leading to a redirection of the gateway's HTTP interface.

What is CVE-2023-4523?

CVE-2023-4523 is a cross-site scripting vulnerability found in Real Time Automation's 460 Series products with versions older than v8.9.8. This vulnerability could enable threat actors to run malicious JavaScript code from the URL, compromising the integrity and confidentiality of the affected systems.

The Impact of CVE-2023-4523

The impact of CVE-2023-4523 is categorized as critical, with a base severity score of 9.4 according to the CVSS v3.1 metrics. The vulnerability has a low attack complexity and occurs over the network, posing a high risk to confidentiality and integrity.

Technical Details of CVE-2023-4523

The following technical aspects shed light on the underlying details of this vulnerability:

Vulnerability Description

The vulnerability allows for cross-site scripting attacks on Real Time Automation's 460 Series products, enabling unauthorized execution of JavaScript code from the URL.

Affected Systems and Versions

Real Time Automation's 460 Series products with versions before v8.9.8 are impacted by this vulnerability.

Exploitation Mechanism

By leveraging this vulnerability, attackers can inject and execute malicious JavaScript code through the URL, potentially leading to unauthorized redirection of the gateway's HTTP interface.

Mitigation and Prevention

To mitigate the risks associated with CVE-2023-4523, users and administrators are advised to take the following steps:

Immediate Steps to Take

Users should download and apply the latest version (v8.9.8) of Real Time Automation's 460 Series products.
Contact Real Time Automation directly for assistance with updating the software and patching the vulnerability.

Long-Term Security Practices

Implement robust security measures such as input validation and output encoding to prevent cross-site scripting attacks.
Regularly update software and firmware to address security vulnerabilities and enhance system resilience.

Patching and Updates

Real Time Automation recommends users to download and apply the new version (v8.9.8) of their 460 Series products to mitigate the cross-site scripting vulnerability. Contact Real Time Automation directly for guidance on updating the software.