Lucene search
NCSC-NLVULNRICHMENT:CVE-2023-41926HistoryJul 02, 2024 - 7:43 a.m.
CVE-2023-41926 Insufficiently protected credentials in Kiloview P1/P2 devices
2024-07-0207:43:16
CWE-522
NCSC-NL
github.com
1
kiloview p1/p2
insufficient protection
basic authentication
encryption disabled
user traffic interception
cve-2023-41926
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
7.2 High
AI Score
Confidence
Low
The webserver utilizes basic authentication for its user login to the configuration interface. As encryption is disabled on port 80, it enables potential eavesdropping on user traffic, making it possible to intercept their credentials.
CNA Affected
[
{
"vendor": "Kiloview",
"product": "P1/P2",
"versions": [
{
"status": "affected",
"version": "All",
"lessThanOrEqual": "4.8.2605",
"versionType": "custom"
}
],
"defaultStatus": "affected"
}
]
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
7.2 High
AI Score
Confidence
Low
Related for VULNRICHMENT:CVE-2023-41926