CVE-2023-22844CWE-321

An authentication bypass vulnerability exists in the requestHandlers.js verifyToken functionality of Milesight VPN v2.0.2

High · published July 6, 2023

CVSS v3.1
7.3
EPSS
1%
Percentile
54.8
In the wild
Unconfirmed
What it is

An authentication bypass vulnerability exists in the requestHandlers.js verifyToken functionality of Milesight VPN v2.0.2. A specially-crafted network request can lead to authentication bypass. An attacker can send a network request to trigger this vulnerability.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00759 · 54.8th percentile
Weakness
CWE-321 · Use of Hard-coded Cryptographic Key
Published
2023-07-06T14:53Z
EPSS history
Timeline
  • 06 JUL 14:53Z
    An authentication bypass vulnerability exists in the requestHandlers.js verifyToken functionality of Milesight VPN v2.0.2
    cvelistv5