CVE-2023-0451

Econolite EOS versions prior to 3.2.23 lack a password requirement for gaining “READONLY” access to log files and certain database and configuration files. One such file contains tables with MD5 hashes and usernames for all defined users in the control software, including administrators and technicians.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-02	Third Party Advisory US Government Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-02	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

cpe:2.3:a:econolite:eos:*:*:*:*:*:*:*:*

History

21 Nov 2024, 07:37

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-01-26 21:18

Updated : 2024-11-21 07:37

NVD link : CVE-2023-0451

Mitre link : CVE-2023-0451

CVE.ORG link : CVE-2023-0451

JSON object : View

Products Affected

econolite

eos

CWE

CWE-284

Improper Access Control

NVD-CWE-Other

{"id": "CVE-2023-0451", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2023-01-26T21:18:08.673", "references": [{"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-02", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-02", "tags": ["Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-284"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Econolite EOS versions prior to 3.2.23 lack a password\nrequirement for gaining \u201cREADONLY\u201d access to log files and certain database and\nconfiguration files. One such file contains tables with MD5 hashes and\nusernames for all defined users in the control software, including\nadministrators and technicians.\n\n\n\n\n\n\n\n"}, {"lang": "es", "value": "Las versiones de Econolite EOS anteriores a la 3.2.23 carecen de un requisito de contrase\u00f1a para obtener acceso \"S\u00d3LO LECTURA\" a los archivos de registro y a determinadas bases de datos y archivos de configuraci\u00f3n. Uno de esos archivos contiene tablas con hash MD5 y nombres de usuario para todos los usuarios definidos en el software de control, incluidos administradores y t\u00e9cnicos.\n\n\n\n"}], "lastModified": "2024-11-21T07:37:12.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:econolite:eos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "65A25AD1-88B9-4680-8F69-81308219D9F1"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}