CVE-2023-0352

2023-03-1321:15:13

[email protected]

web.nvd.nist.gov

akuvox

e11

cve-2023-0352

password recovery

unauthenticated access

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

9.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

49.5%

JSON

The Akuvox E11 password recovery webpage can be accessed without authentication, and an attacker could download the device key file. An attacker could then use this page to reset the password back to the default.

Affected configurations

NVD

Node

akuvoxe11_firmwareMatch-

AND

akuvoxe11Match-

CPENameOperatorVersion
akuvox:e11_firmwareakuvox e11 firmwareeq-

CPE	Name	Operator	Version
akuvox:e11_firmware	akuvox e11 firmware	eq	-

CNA Affected

[
  {
    "vendor": "Akuvox",
    "product": "E11",
    "versions": [
      {
        "status": "affected",
        "version": "All"
      }
    ]
  }
]