by Kastro
Paper/Archive/CVE-2023-0352

CVE-2023-0352

Akuvox E11 — CVE-2023-0352

EPSS 0.6%CVSS 9.1
critical.is priorityof 100
37
CVSS 9.1 (NVD, CNA agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 50.4.504 × 2010.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Akuvox E11 password recovery webpage can be accessed without authentication, and an attacker could download the device key file. An attacker could then use this page to reset the password back to the default.

Affected

ProductAffectedFixed inSource
E11All–CNA

Scores by source

icscert (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-23-068-01