PT-2023-16281 · Econolite · Econolite Eos

Rustam Amin · Published 2023-01-26 · Updated 2023-06-20 · CVE-2023-0452

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Econolite EOS versions prior to 3.2.23

Description The issue concerns the use of a weak hash algorithm for encrypting privileged user credentials. A configuration file, accessible without authentication, utilizes MD5 hashes for credential encryption, including those of administrators and technicians.

Recommendations For versions prior to 3.2.23, update to version 3.2.23 or later to resolve the issue. As a temporary workaround, consider restricting access to the configuration file to minimize the risk of exploitation. Avoid using the MD5 hash algorithm for encrypting credentials until the issue is resolved.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

CWE-328

Related Identifiers

CVE-2023-0452

Affected Products

Econolite Eos

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-0452 · Security Note
• https://t.me/cvenotify/52703 · Telegram Post
• https://t.me/cvenotify/43797 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-23-026-02 · Note