by Kastro
Paper/Archive/CVE-2023-5777

CVE-2023-5777

Weintek EasyBuilder Pro — Weintek EasyBuilder Pro Use of Hard-coded Credentials

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 45.2.452 × 209.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Weintek EasyBuilder Pro contains a vulnerability that, even when the private key is immediately deleted after the crash report transmission is finished, the private key is exposed to the public, which could result in obtaining remote control of the crash report server.

Affected

ProductAffectedFixed inSource
EasyBuilder Pro< v6.07.02v6.07.02CNA
EasyBuilder Pro≤ 6.08.01.592–CNA
EasyBuilder Pro≤ 6.08.02.470–CNA

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-23-306-05