PT-2023-6360 · Connectize · Connectize Ac21000 G6

CVE-2023-24052 · Publicado 2023-10-19 · Atualizado 2024-08-01

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Connectize AC21000 G6 version 641.139.1.1256

Description An issue in the change password functionality of the Connectize AC21000 G6 allows attackers to gain control of the device without prompting for the current password. This is related to weaknesses in the authentication procedure, which can be exploited by a remote attacker to bypass authentication and gain full access to the device.

Recommendations For version 641.139.1.1256, consider disabling the change password functionality until a patch is available to prevent attackers from gaining control of the device. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Improper Authentication

Enumeração de Fraquezas

CWE-863

CWE-287

Identificadores relacionados

BDU:2023-07072

CVE-2023-24052

Produtos afetados

Connectize Ac21000 G6

Referências · 8

• https://osv.dev/vulnerability/CVE-2023-24052 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1731853228055151055 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-24052 · Nota de Segurança
• https://research.nccgroup.com/2023/10/19/technical-advisory-multiple-vulnerabilities-in-connectize-g6-ac2100-dual-band-gigabit-wifi-router-cve-2023-24046-cve-2023-24047-cve-2023-24048-cve-2023-24049-cve-2023-24050-cve-2023-24051-cve · Nota
• https://t.me/cvenotify/62971 · Publicação no Telegram
• https://t.me/malwr/7668 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-07072 · Nota de Segurança
• https://twitter.com/CVEnew/status/1731814836517077042 · Publicação no Twitter