{"id":"CVE-2023-0451","state":"PUBLISHED","title":"Econolite EOS versions prior to 3.2.23 lack a password","description":"Econolite EOS versions prior to 3.2.23 lack a password\nrequirement for gaining “READONLY” access to log files and certain database and\nconfiguration files. One such file contains tables with MD5 hashes and\nusernames for all defined users in the control software, including\nadministrators and technicians.\n\n\n\n\n\n\n\n","publishedAt":"2023-01-26T20:37:53.380Z","updatedAt":"2025-01-16T21:59:03.789Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"icscert"},"assigner":"icscert","products":["Econolite EOS"],"affected":[{"vendor":"Econolite","product":"EOS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.2.23","versionType":"custom"}]}],"references":["https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-02"],"weaknesses":["CWE-284"],"ingestedAt":"2026-10-29T20:05:36.141Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/0xxx/CVE-2023-0451.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-0451","state":"PUBLISHED","datePublished":"2023-01-26T20:37:53.380Z","dateUpdated":"2025-01-16T21:59:03.789Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2023-01-23T18:19:27.265Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Econolite EOS versions prior to 3.2.23 lack a password\nrequirement for gaining “READONLY” access to log files and certain database and\nconfiguration files. One such file contains tables with MD5 hashes and\nusernames for all defined users in the control software, including\nadministrators and technicians.\n\n\n\n\n\n\n\n"}],"affected":[{"vendor":"Econolite","product":"EOS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.2.23","versionType":"custom"}]}],"references":[{"url":"https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-02","tags":["government-resource"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","description":"CWE-284 Improper Access Control","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2023-06-20T15:37:19.367Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Rustam Amin"},{"lang":"en","type":"reporter","user":"00000000-0000-4000-9000-000000000000","value":"Rustam Amin"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-02","tags":["government-resource","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T05:10:56.170Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-01-16T20:57:04.944910Z","id":"CVE-2023-0451","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-01-16T21:59:03.789Z"}}]}}}