CVE-2023-49340

An issue was discovered in Newland Nquire 1000 Interactive Kiosk version NQ1000-II_G_V1.00.011, allows remote attackers to escalate privileges and bypass…

Critical · published March 9, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
58.0
In the wild
Unconfirmed
What it is

🚨 Just a few clicks in the Newland Nquire 1000 Kiosk’s management portal can give attackers the keys to the kingdom! 🔥 Think of it like a poorly monitored hotel lobby where anyone can waltz in and change the room assignments—now you’ve got guests in the wrong rooms and maybe even access to the safe! 🏨 An attacker could gain escalated privileges, allowing them to bypass authentication entirely. This means they could manipulate settings, access sensitive data, or even turn the kiosk into a malicious tool—imagine the chaos!

Put simply

Think of it like a poorly monitored hotel lobby where anyone can waltz in and change the room assignments—now you’ve got guests in the wrong rooms and maybe even access to the safe! 🏨 This vulnerability arises from incorrect access controls in the web management portal of the Newland Nquire 1000 Interactive Kiosk, enabling unauthorized users to escalate their privileges remotely.

What to do

An attacker could gain escalated privileges, allowing them to bypass authentication entirely. This means they could manipulate settings, access sensitive data, or even turn the kiosk into a malicious tool—imagine the chaos! Patch to version NQ1000-II_G_V1.00.012 immediately to close this security hole. Regularly audit your access controls and monitor for any suspicious activity on the kiosks. 🛡️ You've got this! Secure your kiosks and keep your data safe—let’s turn this vulnerability into a victory! 💪🎉

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00858 · 58.0th percentile
Published
2024-03-09T00:00Z
EPSS history
Timeline
  • 09 MAR 00:00Z
    An issue was discovered in Newland Nquire 1000 Interactive Kiosk version NQ1000-II_G_V1.00.011, allows remote attackers to escalate privileges and bypass…
    cvelistv5