CVE-2023-41920CWE-305

Authentication Bypass by Primary Weakness in Kiloview P1/P2 devices

Critical · published July 2, 2024

CVSS v3.1
9.8
EPSS
0%
Percentile
35.4
In the wild
Unconfirmed
What it is

🚨 A root account just unlocked with no password needed! If your device has the IP 10.10.10.10, the door is thrown wide open for attackers. 🔥 This vulnerability is like leaving your front door wide open without even a lock, inviting anyone walking by to come in and take whatever they want. It's the ultimate welcome mat for intruders! An attacker could walk right in and take complete control of the system—changing settings, accessing sensitive data, or even launching attacks on other systems. This is an absolutely devastating breach that could lead to severe consequences for any organization.

Put simply

This vulnerability is like leaving your front door wide open without even a lock, inviting anyone walking by to come in and take whatever they want. It's the ultimate welcome mat for intruders! This critical vulnerability allows unauthorized access to the root account due to a misconfiguration involving the specific IP address 10.10.10.10, bypassing authentication entirely.

What to do

An attacker could walk right in and take complete control of the system—changing settings, accessing sensitive data, or even launching attacks on other systems. This is an absolutely devastating breach that could lead to severe consequences for any organization. To fix this, immediately change your device's IP address if it is currently set to 10.10.10.10 and ensure that proper authentication mechanisms are in place. Additionally, check for any other misconfigurations that could expose sensitive accounts. Patch your systems as soon as the vendor releases an update. You've got this! Secure your systems and close that door—no uninvited guests allowed! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00421 · 35.4th percentile
Weakness
CWE-305 · Authentication Bypass by Primary Weakness
Published
2024-07-02T07:42Z
EPSS history
Timeline
  • 02 JUL 07:42Z
    Authentication Bypass by Primary Weakness in Kiloview P1/P2 devices
    cvelistv5