CVE-2023-6928CWE-307

Improper Restriction of Excessive Authentication Attempts

Critical · published December 19, 2023

CVSS v3.1
9.8
EPSS
1%
Percentile
55.1
In the wild
Unconfirmed
What it is

🔥 No limit on password guessing attempts? That's like leaving your front door wide open with a welcome sign! Picture this: a hotel lobby where anyone can try every room key without restriction. The receptionist just stands by, watching, while the guests remain blissfully unaware of the intruder's attempts to access their rooms. That’s how EuroTel ETL3100 systems are currently handling admin password attempts! An attacker could simply keep guessing until they find the right password, gaining full control of the system and potentially exposing sensitive data or even shutting down operations entirely. This is absolutely devastating for any organization that relies on these systems—imagine an intruder taking over critical functions without a single alarm being triggered!

Put simply

Picture this: a hotel lobby where anyone can try every room key without restriction. The receptionist just stands by, watching, while the guests remain blissfully unaware of the intruder's attempts to access their rooms. That’s how EuroTel ETL3100 systems are currently handling admin password attempts! CVE-2023-6928 affects EuroTel ETL3100 versions v01c01 and v01x37, which fail to implement a rate limit on administrative password attempts, making it easy for attackers to brute-force their way in.

What to do

An attacker could simply keep guessing until they find the right password, gaining full control of the system and potentially exposing sensitive data or even shutting down operations entirely. This is absolutely devastating for any organization that relies on these systems—imagine an intruder taking over critical functions without a single alarm being triggered! Immediately implement a patch or upgrade to secure versions of EuroTel ETL3100. In addition, configure account lockout mechanisms after a certain number of failed attempts to drastically reduce the risk of unauthorized access. Regularly audit your password policies to ensure they are robust against such threats. You've got this! With these steps, you're taking major strides toward securing your systems. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00769 · 55.1th percentile
Weakness
CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2023-12-19T22:58Z
EPSS history
Timeline
  • 19 DEC 22:58Z
    Improper Restriction of Excessive Authentication Attempts
    cvelistv5