CVE-2023-45321

CVSS 3.1 Score 8.8 of 10 (high)

Details

Published Oct 25, 2023
Updated: Nov 6, 2023
CWE ID 319

Summary

CVE-2023-45321 is a vulnerability that affects the Android Client application when enrolled with method 1. The application uses HTTP instead of HTTPS to retrieve sensitive information, such as IP address and credentials, to connect to a remote MQTT broker entity. This lack of encryption allows an attacker in the same subnet network to intercept the username and password needed to authenticate with the MQTT server for remote management. The affected products include tJAxCs, tJAxCq, and tJAxCu. The potential danger of this vulnerability is high, with a base severity rating of HIGH and confidentiality and integrity impacts also rated as HIGH. The exploitability score is 2.8 out of 10, indicating a moderate level of difficulty for an attacker. It is crucial for organizations to remediate this vulnerability by implementing HTTPS instead of HTTP for retrieving sensitive information on the Android Client application.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-45321 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options