PT-2023-8988 · Chamberlain · Myq

Published

2023-01-23

·

Updated

2023-03-27

·

CVE-2023-24080

CVSS v2.0

10

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Chamberlain myQ version 5.222.0.32277
Description The issue is related to insufficient restriction of authentication attempts, allowing a remote attacker to bypass existing security restrictions using a brute force attack. This is due to a lack of rate limiting on the password reset endpoint, which enables attackers to compromise user accounts via a brute force attack.
Recommendations For version 5.222.0.32277, consider disabling the password reset feature until a patch is available to prevent brute force attacks. Restrict access to the password reset endpoint to minimize the risk of exploitation. Avoid using the password reset feature in the affected version until the issue is resolved.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

BDU:2024-02870
CVE-2023-24080

Affected Products

Myq