Riskcovery

CVE-2023-0321

Disclosure of Sensitive Information on Campbell Scientific Products

State
Published
Severity
9.1 Critical
Published
Jan 25, 2023
Updated
Mar 27, 2025
Reserved
Jan 16, 2023

Read the record on cve.org

Description

Campbell Scientific dataloggers CR6, CR300, CR800, CR1000 and CR3000 may allow an attacker to download configuration files, which may contain sensitive information about the internal network. From factory defaults, the mentioned datalogges have HTTP and PakBus enabled. The devices, with the default configuration, allow this situation via the PakBus port. The exploitation of this vulnerability may allow an attacker to download, modify, and upload new configuration files.

Scores

CVSSScoreVectorSource
3.19.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NINCIBE

Weaknesses

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

ProductVersions
CR6Campbell Scientific
  • all versionAffected
CR300Campbell Scientific
  • all versionAffected
CR800Campbell Scientific
  • all versionAffected
CR1000Campbell Scientific
  • all versionAffected
CR3000Campbell Scientific
  • all versionAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.