Paper/Archive/CVE-2023-4344

CVE-2023-4344

Broadcom LSI Storage Authority (LSA) — Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to setup CIM connection

EPSS 0.7%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 53.3.533 × 2010.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to setup CIM connection

Affected

ProductAffectedFixed inSource

LSI Storage Authority (LSA)< 7.017.011.0007.017.011.000CNA

RAID Web Console 3 (RWC3)< 7.017.011.0007.017.011.000CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refbroadcom.com/support/resources/product-security-center refintel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html