CVE-2023-33379

Connected IO v2.1.0 and prior has a misconfiguration in their MQTT broker used for management and device communication, which allows devices to connect to the broker and issue commands to other device, impersonating Connected IO management platform and sending commands to all of Connected IO's devices.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:connectedio:er2000t-vz-cat1_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:connectedio:er2000t-vz-cat1:-:*:*:*:*:*:*:*

History

21 Nov 2024, 08:05

Type Values Removed Values Added
References () https://claroty.com/team82/disclosure-dashboard/cve-2023-33379 - Third Party Advisory () https://claroty.com/team82/disclosure-dashboard/cve-2023-33379 - Third Party Advisory
References () https://www.connectedio.com/products/routers - Product () https://www.connectedio.com/products/routers - Product
Summary
  • (es) Connected IO v2.1.0 y anteriores tiene un error de configuración en su broker MQTT utilizado para la gestión y comunicación de dispositivos, que permite a los dispositivos conectarse al broker y emitir comandos a otro dispositivo, haciéndose pasar por la plataforma de gestión de Connected IO y enviando comandos a todos los dispositivos de Connected IO.

10 Aug 2023, 15:34

Type Values Removed Values Added
References (MISC) https://www.connectedio.com/products/routers - (MISC) https://www.connectedio.com/products/routers - Product
References (MISC) https://claroty.com/team82/disclosure-dashboard/cve-2023-33379 - (MISC) https://claroty.com/team82/disclosure-dashboard/cve-2023-33379 - Third Party Advisory
CWE NVD-CWE-noinfo
CPE cpe:2.3:o:connectedio:er2000t-vz-cat1_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:connectedio:er2000t-vz-cat1:-:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 9.8

04 Aug 2023, 18:53

Type Values Removed Values Added
New CVE

Information

Published : 2023-08-04 18:15

Updated : 2024-11-21 08:05


NVD link : CVE-2023-33379

Mitre link : CVE-2023-33379

CVE.ORG link : CVE-2023-33379


JSON object : View

Products Affected

connectedio

  • er2000t-vz-cat1_firmware
  • er2000t-vz-cat1