CVE-2023-45321
CVSS 3.1 Score 8.8 of 10 (high)
Details
Summary
CVE-2023-45321 is a vulnerability that affects the Android Client application when enrolled with method 1. The application uses HTTP instead of HTTPS to retrieve sensitive information, such as IP address and credentials, to connect to a remote MQTT broker entity. This lack of encryption allows an attacker in the same subnet network to intercept the username and password needed to authenticate with the MQTT server for remote management. The affected products include tJAxCs, tJAxCq, and tJAxCu. The potential danger of this vulnerability is high, with a base severity rating of HIGH and confidentiality and integrity impacts also rated as HIGH. The exploitability score is 2.8 out of 10, indicating a moderate level of difficulty for an attacker. It is crucial for organizations to remediate this vulnerability by implementing HTTPS instead of HTTP for retrieving sensitive information on the Android Client application.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions