title: Check Point IoT integration: WebSocket returns assets data without authentication in Guardian/CMC before 23.3.0
description: A missing authentication check in the WebSocket channel used for the Check Point IoT integration in Nozomi Networks Guardian and CMC, may allow an unauthenticated attacker to obtain assets data without authentication.
Malicious unauthenticated users with knowledge on the underlying system may be able to extract asset information.
problem types: CWE-306 Missing Authentication for Critical Function
affected:
{
defaultStatus: unaffected
product: Guardian
vendor: Nozomi Networks
versions:
lessThan: 23.3.0, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: CMC
vendor: Nozomi Networks
versions:
lessThan: 23.3.0, status: affected, version: 0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Upgrade to v23.3.0 or later.
workarounds: Use internal firewall features to limit access to the web management interface.