CVE-2023-0452

Econolite EOS versions prior to 3.2.23 use a weak hash algorithm for encrypting privileged user credentials. A configuration file that is accessible without authentication uses MD5 hashes for encrypting credentials, including those of administrators and technicians.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-02	Third Party Advisory US Government Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-02	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

cpe:2.3:a:econolite:eos:*:*:*:*:*:*:*:*

History

21 Nov 2024, 07:37

Type	Values Removed	Values Added
References	~~() https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-02 - Third Party Advisory, US Government Resource~~	() https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-02 - Third Party Advisory, US Government Resource
CVSS	v2 : ~~unknown~~ v3 : ~~5.3~~	v2 : unknown v3 : 9.8
Summary		(es) Las versiones de Econolite EOS anteriores a la 3.2.23 utilizan un algoritmo hash débil para cifrar las credenciales de usuarios privilegiados. Un archivo de configuración al que se puede acceder sin autenticación utiliza hashes MD5 para cifrar las credenciales, incluidas las de administradores y técnicos.

Information

Published : 2023-01-26 21:18

Updated : 2024-11-21 07:37

NVD link : CVE-2023-0452

Mitre link : CVE-2023-0452

CVE.ORG link : CVE-2023-0452

JSON object : View

Products Affected

econolite

eos

CWE

CWE-328

Use of Weak Hash

CWE-327

Use of a Broken or Risky Cryptographic Algorithm

{"id": "CVE-2023-0452", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2023-01-26T21:18:08.860", "references": [{"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-02", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-02", "tags": ["Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-328"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-327"}]}], "descriptions": [{"lang": "en", "value": "Econolite EOS versions prior to 3.2.23 use a weak hash\nalgorithm for encrypting privileged user credentials. A configuration file that\nis accessible without authentication uses MD5 hashes for encrypting\ncredentials, including those of administrators and technicians.\n\n\n\n\n\n\n\n"}, {"lang": "es", "value": "Las versiones de Econolite EOS anteriores a la 3.2.23 utilizan un algoritmo hash d\u00e9bil para cifrar las credenciales de usuarios privilegiados. Un archivo de configuraci\u00f3n al que se puede acceder sin autenticaci\u00f3n utiliza hashes MD5 para cifrar las credenciales, incluidas las de administradores y t\u00e9cnicos.\n\n\n"}], "lastModified": "2024-11-21T07:37:12.257", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:econolite:eos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "65A25AD1-88B9-4680-8F69-81308219D9F1"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}