PT-2023-24321 · Unknown · Connected Io

CVE-2023-33372 · Publicado 2023-08-04 · Atualizado 2023-08-08

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Connected IO versions 2.1.0 and prior

Description The issue concerns the use of a hard-coded username/password pair in the device's firmware for communication via MQTT. An attacker gaining access to these credentials can connect to the MQTT broker, send messages on behalf of devices, and impersonate them. This also allows attackers to sign and verify JWT session tokens, enabling them to sign arbitrary session tokens and bypass authentication.

Recommendations For Connected IO versions 2.1.0 and prior, consider disabling the use of hard-coded credentials for MQTT communication until a patch is available. Restrict access to the MQTT broker to minimize the risk of exploitation. Avoid using the hard-coded username and password in device communication until the issue is resolved.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2023-33372

Produtos afetados

Connected Io

Referências · 6

• https://t.me/cvenotify/56024 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-33372 · Nota de Segurança
• https://connectedio.com/products/routers · Nota
• https://t.me/cibsecurity/67787 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-33372 · Aviso do Fabricante
• https://claroty.com/team82/disclosure-dashboard/cve-2023-33372 · Nota