CVE-2023-3065CWE-287

Mobatime mobile application - Authentication bypass

Critical · published June 5, 2023

CVSS v3.1
9.1
EPSS
1%
Percentile
55.5
In the wild
Unconfirmed
What it is

🚨 Hold onto your devices! A staggering flaw in the Mobatime AMXGT100 mobile app allows attackers to bypass authentication like a VIP guest crashing a private party. 🔥 Think of it as a bouncer at a nightclub who takes a nap, letting anyone walk through the door without checking IDs—an invitation to chaos! An attacker could potentially access sensitive features of the application and manipulate data, leading to unauthorized actions that could jeopardize user privacy and the integrity of operations. It's a scenario that could result in absolutely devastating breaches if exploited!

Put simply

Think of it as a bouncer at a nightclub who takes a nap, letting anyone walk through the door without checking IDs—an invitation to chaos! This vulnerability, CVE-2023-3065, stems from improper authentication checks that allow attackers to bypass security measures in the Mobatime mobile application AMXGT100, specifically versions up to 1.3.20.

What to do

An attacker could potentially access sensitive features of the application and manipulate data, leading to unauthorized actions that could jeopardize user privacy and the integrity of operations. It's a scenario that could result in absolutely devastating breaches if exploited! Immediate action is crucial: Update the Mobatime AMXGT100 app to version 1.3.21 or later. It’s also a good idea to review your authentication mechanisms to ensure robust security practices are in place. You've got this! With a quick update, you'll secure your app and keep those unauthorized users at bay! 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00783 · 55.5th percentile
Weakness
CWE-287 · Improper Authentication
Published
2023-06-05T08:27Z
EPSS history
Timeline
  • 05 JUN 08:27Z
    Mobatime mobile application - Authentication bypass
    cvelistv5