PT-2024-14280 · Skyworth · Skyworth Router Cm5100

Dr. Faruk Kazi + 3 · Published 2024-01-17 · Updated 2024-01-20 · CVE-2023-51741

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Skyworth Router CM5100 version 4.1.1.24

Description This issue exists due to the transmission of authentication credentials in plaintext over the network. A remote attacker could exploit this by eavesdropping on the victim’s network traffic to extract the username and password from the web interface, specifically the Password Reset Page, of the targeted system.

Recommendations For Skyworth Router CM5100 version 4.1.1.24, consider disabling the Password Reset Page functionality until a patch is available to prevent exploitation. Restrict access to the web interface to minimize the risk of eavesdropping and credential extraction.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2023-51741

Affected Products

Skyworth Router Cm5100

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-51741 · Security Note
• https://osv.dev/vulnerability/CVE-2023-51741 · Vendor Advisory
• https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0013 · Note
• https://twitter.com/CVEnew/status/1747527251820683267 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1747582155981496423 · Twitter Post