by Kastro
Paper/Archive/CVE-2023-33468

CVE-2023-33468

kramerav via_connect2 — KramerAV VIA Connect (2) and VIA Go (2) devices with a version prior to 4.0.1.1326 exhibit a vulnerability that enables remote manipulati…

EPSS 0.8%public exploitCVSS 9.1
critical.is priorityof 100
48
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 55.4.554 × 2011.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

KramerAV VIA Connect (2) and VIA Go (2) devices with a version prior to 4.0.1.1326 exhibit a vulnerability that enables remote manipulation of the device. This vulnerability involves extracting the connection confirmation code remotely, bypassing the need to obtain it directly from the physical screen.

Affected

ProductAffectedFixed inSource
n/an/a–CNA
via_connect2< 4.0.1.13264.0.1.1326CISA-ADP
via_go2< 4.0.1.13264.0.1.1326CISA-ADP

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/Sharpe-nl/CVEs/tree/main/CVE-2023-33468