CVE-2023-0452

Опубликовано: 26 янв. 2023

Источник: nvd

CVSS3: 9.8

CVSS3: 5.3

EPSS Низкий

Описание

Econolite EOS versions prior to 3.2.23 use a weak hash algorithm for encrypting privileged user credentials. A configuration file that is accessible without authentication uses MD5 hashes for encrypting credentials, including those of administrators and technicians.

Ссылки

https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-02
Third Party Advisory
US Government Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-02
Third Party Advisory
US Government Resource

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:econolite:eos:*:*:*:*:*:*:*:*

EPSS

Процентиль: 27%

0.00095

Низкий

9.8 Critical

CVSS3

5.3 Medium

CVSS3

Дефекты

CWE-328

CWE-327

Связанные уязвимости

GHSA-48vq-44vm-p326

CVSS3: 5.3

github

около 3 лет назад

All versions of Econolite EOS traffic control software are vulnerable to CWE-328: Use of Weak Hash, and use a weak hash algorithm for encrypting privileged user credentials. A configuration file that is accessible without authentication uses MD5 hashes for encrypting credentials, including those of administrators and technicians.

EPSS

Процентиль: 27%

0.00095

Низкий

9.8 Critical

CVSS3

5.3 Medium

CVSS3

Дефекты

CWE-328

CWE-327