CVE-2023-0451CWE-284

Econolite EOS versions prior to 3.2.23 lack a password requirement for gaining “READONLY” access to log files and certain database and configuration files

High · published January 26, 2023

CVSS v3.1
7.5
EPSS
1%
Percentile
57.0
In the wild
Unconfirmed
What it is

Econolite EOS versions prior to 3.2.23 lack a password

requirement for gaining “READONLY” access to log files and certain database and

configuration files. One such file contains tables with MD5 hashes and

usernames for all defined users in the control software, including

administrators and technicians.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00825 · 57.0th percentile
Weakness
CWE-284 · Improper Access Control
Published
2023-01-26T20:37Z
EPSS history
Timeline
  • 26 JAN 20:37Z
    Econolite EOS versions prior to 3.2.23 lack a password requirement for gaining “READONLY” access to log files and certain database and configuration files
    cvelistv5