CVE-2023-0321 Information

Description

Campbell Scientific dataloggers CR6 CR300 CR800 CR1000 and CR3000 may allow an attacker to download configuration files which may contain sensitive information about the internal network. From factory defaults the mentioned datalogges have HTTP and PakBus enabled. The devices with the default configuration allow this situation via the PakBus port. The exploitation of this vulnerability may allow an attacker to download modify and upload new configuration files.

Reference

https://www.incibe-cert.es/en/early-warning/ics-advisories/disclosure-sensitive-information-campbell-scientific-products https://www.hackplayers.com/2023/01/cve-2023-0321-info-sensible-campbell.html