PT-2023-6360 · Connectize · Connectize Ac21000 G6

Published 2023-10-19 · Updated 2024-08-01 · CVE-2023-24052

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Connectize AC21000 G6 version 641.139.1.1256

Description An issue in the change password functionality of the Connectize AC21000 G6 allows attackers to gain control of the device without prompting for the current password. This is related to weaknesses in the authentication procedure, which can be exploited by a remote attacker to bypass authentication and gain full access to the device.

Recommendations For version 641.139.1.1256, consider disabling the change password functionality until a patch is available to prevent attackers from gaining control of the device. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Improper Authentication

Weakness Enumeration

CWE-863

CWE-287

Related Identifiers

BDU:2023-07072

CVE-2023-24052

Affected Products

Connectize Ac21000 G6

References · 8

• https://osv.dev/vulnerability/CVE-2023-24052 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-24052 · Security Note
• https://bdu.fstec.ru/vul/2023-07072 · Security Note
• https://twitter.com/VulmonFeeds/status/1731853228055151055 · Twitter Post
• https://research.nccgroup.com/2023/10/19/technical-advisory-multiple-vulnerabilities-in-connectize-g6-ac2100-dual-band-gigabit-wifi-router-cve-2023-24046-cve-2023-24047-cve-2023-24048-cve-2023-24049-cve-2023-24050-cve-2023-24051-cve · Note
• https://t.me/cvenotify/62971 · Telegram Post
• https://t.me/malwr/7668 · Telegram Post
• https://twitter.com/CVEnew/status/1731814836517077042 · Twitter Post