CVE-2023-2759CWE-863

TAPHOME Improper Authentication in Core Platform

High · published July 17, 2023

CVSS v3.1
8.8
EPSS
1%
Percentile
45.5
In the wild
Unconfirmed
What it is

A hidden API exists in TapHome's core platform before version 2023.2 that allows an authenticated, low privileged user to change passwords of other users without any prior knowledge. The attacker may gain full access to the device by using this vulnerability.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00555 · 45.5th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2023-07-17T06:14Z
EPSS history
Timeline
  • 17 JUL 06:14Z
    TAPHOME Improper Authentication in Core Platform
    cvelistv5