Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR16, 4.0.0 SR06, 4.1.0 SR04, 4.2.0 SR03, and 4.3.0 SR01 fails to validate symlinks during the Pre-Boot Authorization (PBA) process. This can be exploited by a physical attacker who is able to manipulate the contents of the systems hard disk.
Weakness
The product does not validate or incorrectly validates the integrity check values or “checksums” of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Vynamic_security_suite | Dieboldnixdorf | * | 3.3.0sr16 (excluding) |
| Vynamic_security_suite | Dieboldnixdorf | 4.0.0 (including) | 4.0.0sr06 (excluding) |
| Vynamic_security_suite | Dieboldnixdorf | 4.1.0 (including) | 4.1.0sr04 (excluding) |
| Vynamic_security_suite | Dieboldnixdorf | 4.2.0 (including) | 4.2.0sr03 (excluding) |
| Vynamic_security_suite | Dieboldnixdorf | 4.3.0 (including) | 4.3.0sr01 (excluding) |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/145.html
- https://cwe.mitre.org/data/definitions/463.html
- https://cwe.mitre.org/data/definitions/75.html