PT-2023-8987 · Akuvox · Akuvox E11

Published 2023-03-13 · Updated 2023-03-16 · CVE-2023-0345

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Akuvox E11 (affected versions not specified)

Description The issue is related to the Akuvox E11 secure shell (SSH) server, which is enabled by default and accessible by the root user with a password that cannot be changed by the user. This concern is associated with the use of pre-installed credentials. Exploitation of this issue may allow a remote attacker to elevate their privileges to the root level.

Recommendations For Akuvox E11, consider disabling the SSH server until a configuration change or update is available to secure the default credentials. As a temporary workaround, restrict access to the device to minimize the risk of exploitation.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2024-02867

CVE-2023-0345

Affected Products

Akuvox E11

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-0345 · Security Note
• https://bdu.fstec.ru/vul/2024-02867 · Security Note
• https://cisa.gov/news-events/ics-advisories/icsa-23-068-01 · Note
• https://t.me/true_secator/4158 · Telegram Post
• https://claroty.com/team82/disclosure-dashboard/cve-2023-0345 · Note