CVE-2023-0452 CRITICAL

CVE-2023-0452

Vendor Econolite
Product EOS
Weakness CWE-328 · Weak hash
Published January 26, 2023
Last update January 16, 2025

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Econolite EOS versions prior to 3.2.23 use a weak hash algorithm for encrypting privileged user credentials. A configuration file that is accessible without authentication uses MD5 hashes for encrypting credentials, including those of administrators and technicians.

Key dates

02Disclosure timeline

January 26, 2023 CVE published
January 16, 2025 Record updated