CVE-2023-3243CWE-290CWE-326

** UNSUPPORTED WHEN ASSIGNED ** [An attacker can capture an authenticating hash and utilize it to create new sessions

High · published June 28, 2023

CVSS v3.1
8.3
EPSS
1%
Percentile
48.3
In the wild
Unconfirmed
What it is

** UNSUPPORTED WHEN ASSIGNED ** [An attacker can capture an authenticating hash

and utilize it to create new sessions. The hash is also a poorly salted MD5

hash, which could result in a successful brute force password attack. Impacted product is BCM-WEB version 3.3.X. Recommended fix: Upgrade to a supported product such

as Alerton

ACM.] Out of an abundance of caution, this CVE ID is being assigned to

better serve our customers and ensure all who are still running this product understand

that the product is end of life and should be removed or upgraded.

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00606 · 48.3th percentile
Weaknesses
CWE-290 · Authentication Bypass by Spoofing; CWE-326 · Inadequate Encryption Strength
Published
2023-06-28T20:23Z
EPSS history
Timeline
  • 28 JUN 20:23Z
    ** UNSUPPORTED WHEN ASSIGNED ** [An attacker can capture an authenticating hash and utilize it to create new sessions
    cvelistv5