PT-2023-16281 · Econolite · Econolite Eos

Rustam Amin · Publicado 2023-01-26 · Atualizado 2023-06-20 · CVE-2023-0452

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Econolite EOS versions prior to 3.2.23

Description The issue concerns the use of a weak hash algorithm for encrypting privileged user credentials. A configuration file, accessible without authentication, utilizes MD5 hashes for credential encryption, including those of administrators and technicians.

Recommendations For versions prior to 3.2.23, update to version 3.2.23 or later to resolve the issue. As a temporary workaround, consider restricting access to the configuration file to minimize the risk of exploitation. Avoid using the MD5 hash algorithm for encrypting credentials until the issue is resolved.

Correção

Use of a Broken Cryptographic Algorithm

Enumeração de Fraquezas

CWE-327

CWE-328

Identificadores relacionados

CVE-2023-0452

Produtos afetados

Econolite Eos

Referências · 4

• https://t.me/cvenotify/52703 · Publicação no Telegram
• https://t.me/cvenotify/43797 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-0452 · Nota de Segurança
• https://cisa.gov/uscert/ics/advisories/icsa-23-026-02 · Nota