Lucene search

IcscertCVELIST:CVE-2023-0451

HistoryJan 26, 2023 - 8:37 p.m.

CVE-2023-0451

2023-01-2620:37:53

CWE-284

icscert

www.cve.org

econolite eos

vulnerability

unauthorized access

sensitive data

password requirement

md5 hashes

administrators

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

49.0%

JSON

Econolite EOS versions prior to 3.2.23 lack a password
requirement for gaining “READONLY” access to log files and certain database and
configuration files. One such file contains tables with MD5 hashes and
usernames for all defined users in the control software, including
administrators and technicians.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "EOS",
    "vendor": "Econolite",
    "versions": [
      {
        "lessThan": "3.2.23",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cisa.gov/uscert/ics/advisories/icsa-23-026-02

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

49.0%

JSON

Related for CVELIST:CVE-2023-0451