CVE-2023-0451

Published Jan 26, 2023

Last updated a year ago

Overview

Description: Econolite EOS versions prior to 3.2.23 lack a password requirement for gaining “READONLY” access to log files and certain database and configuration files. One such file contains tables with MD5 hashes and usernames for all defined users in the control software, including administrators and technicians.
Source: ics-cert@hq.dhs.gov
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity: HIGH

Weaknesses

ics-cert@hq.dhs.gov: CWE-284
nvd@nist.gov: NVD-CWE-Other

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:econolite:eos:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "65A25AD1-88B9-4680-8F69-81308219D9F1"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References