CVE-2023-7007: Sciener Gateway G2 · Authentication Bypass by Spoofing
Affects Sciener Gateway G2Source CVE Database V5
Not known to be exploited · CVSS 8.2 High.
Data as of 26 Oct 2026, 10:12 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 32% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 15 Mar 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Sciener Gateway G2 | Affected
| Fixed in– |
AI-suggested
- Immediate mitigation involves isolating the Sciener Gateway G2 devices within segmented network zones to limit exposure to untrusted networks.
- Implement strict network access controls and firewall rules to restrict inbound connections to the devices only from trusted management servers.
- Monitor network traffic for anomalous connection attempts or spoofing behaviors targeting the Gateway G2 devices.
- Enforce multi-factor authentication and device identity verification mechanisms where possible to supplement the device’s native authentication.
- Engage with the vendor (Sciener) for updates or patches addressing this vulnerability and prioritize their deployment once available.
- Conduct regular security audits and penetration testing focused on IoT devices and their integration points.
- Educate security teams and facility managers about the risks of device impersonation and the importance of physical and network security controls.
- Consider deploying intrusion detection/prevention systems (IDS/IPS) tuned to detect spoofing or unauthorized access attempts on IoT device protocols.
Description
Sciener server does not validate connection requests from the GatewayG2, allowing an impersonation attack that provides the attacker the unlockKey field.