Weintek EasyBuilder Pro Use of Hard-coded Credentials
CVE-2023-5777

9.8CRITICAL

Key Information:

Vendor

Weintek

Status
Easybuilder Pro
Vendor
CVE Published:
6 November 2023

What is CVE-2023-5777?

Weintek EasyBuilder Pro features a vulnerability that could potentially grant unauthorized access to the crash report server due to the exposure of the private key. Even when this key is promptly deleted following the transmission of crash reports, it remains accessible to malicious actors, leading to serious security risks. This issue necessitates immediate awareness and remediation to protect sensitive data and system integrity.

Affected Version(s)

EasyBuilder Pro 0

EasyBuilder Pro 0 <= 6.08.01.592

EasyBuilder Pro 0 <= 6.08.02.470

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-3...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Hank Chen (PSIRT and Threat Research of TXOne Networks) reported this vulnerability to CISA.
.