CVE-2023-0451

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-0451
Econolite EOS versions prior to 3.2.23 lack a password requirement for gaining “READONLY” access to log files and certain database and configuration files. One such file contains tables with MD5 hashes and usernames for all defined users in the control software, including administrators and technicians.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-02 Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

cpe:2.3:a:econolite:eos:*:*:*:*:*:*:*:*
History

20 Jun 2023, 16:15

Type Values Removed Values Added
CWE NVD-CWE-Other CWE-284
Summary All versions of Econolite EOS traffic control software are vulnerable to CWE-284: Improper Access Control, and lack a password requirement for gaining “READONLY” access to log files, as well as certain database and configuration files. One such file contains tables with message-digest algorithm 5 (MD5) hashes and usernames for all defined users in the control software, including administrators and technicians. Econolite EOS versions prior to 3.2.23 lack a password requirement for gaining “READONLY” access to log files and certain database and configuration files. One such file contains tables with MD5 hashes and usernames for all defined users in the control software, including administrators and technicians.
Information

Published : 2023-01-26 21:18

Updated : 2024-02-28 19:51

NVD link : CVE-2023-0451

Mitre link : CVE-2023-0451

CVE.ORG link : CVE-2023-0451

JSON object : View

Products Affected

econolite

  • eos
CWE
CWE-284

Improper Access Control

NVD-CWE-Other