CVE-2023-35837

An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02

Critical · published January 23, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
61.8
In the wild
Unconfirmed
What it is

🚨 Default passwords in an unsecured WiFi interface make for an open invitation. With the SolaX Pocket WiFi 3, an attacker only needs to connect to the device's WiFi to waltz right into the admin panel! 🔥 Think of it like a hotel with an open front door and a welcome mat that says 'Come on in!'—the administrative password is the same as the guest ID number, making it simple for anyone to check in and take control. 🏨 An attacker can reconfigure the device, upload malicious firmware, or even launch a Denial of Service attack. This could lead to compromised privacy, disrupted connections, or worse—your device being turned against you! Absolutely devastating for anyone relying on this technology.

Put simply

Think of it like a hotel with an open front door and a welcome mat that says 'Come on in!'—the administrative password is the same as the guest ID number, making it simple for anyone to check in and take control. 🏨 This vulnerability stems from an unauthenticated WiFi access point that uses a default administrative password, which is simply the registration ID used as the WiFi SSID. Once inside, attackers can manipulate device settings or execute arbitrary code.

What to do

An attacker can reconfigure the device, upload malicious firmware, or even launch a Denial of Service attack. This could lead to compromised privacy, disrupted connections, or worse—your device being turned against you! Absolutely devastating for anyone relying on this technology. Immediately change the default administrative password after installation and ensure that users are prompted to do so. Update to the latest version from SolaX, and consider implementing stronger authentication methods if possible. 🛡️ You’ve got this! By following these steps, you can secure your device and keep those digital doors locked tight! 💪✨

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00976 · 61.8th percentile
Published
2024-01-23T00:00Z
EPSS history
Timeline
  • 23 JAN 00:00Z
    An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02
    cvelistv5