PT-2023-24321 · Unknown · Connected Io

Published 2023-08-04 · Updated 2023-08-08 · CVE-2023-33372

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Connected IO versions 2.1.0 and prior

Description The issue concerns the use of a hard-coded username/password pair in the device's firmware for communication via MQTT. An attacker gaining access to these credentials can connect to the MQTT broker, send messages on behalf of devices, and impersonate them. This also allows attackers to sign and verify JWT session tokens, enabling them to sign arbitrary session tokens and bypass authentication.

Recommendations For Connected IO versions 2.1.0 and prior, consider disabling the use of hard-coded credentials for MQTT communication until a patch is available. Restrict access to the MQTT broker to minimize the risk of exploitation. Avoid using the hard-coded username and password in device communication until the issue is resolved.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2023-33372

Affected Products

Connected Io

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-33372 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33372 · Vendor Advisory
• https://t.me/cvenotify/56024 · Telegram Post
• https://connectedio.com/products/routers · Note
• https://t.me/cibsecurity/67787 · Telegram Post
• https://claroty.com/team82/disclosure-dashboard/cve-2023-33372 · Note