CVE-2023-43777

Eaton easySoft software is used to program easy controllers and displays for configuring, programming and defining parameters for all the intelligent relays. This software has a password protection functionality to secure the project file from unauthorized access. This password was being stored insecurely and could be retrieved by skilled adversaries.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2023-1011.pdf	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:eaton:easysoft:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-10-17 13:15

Updated : 2023-10-25 12:34

NVD link : CVE-2023-43777

Mitre link : CVE-2023-43777

CVE.ORG link : CVE-2023-43777

JSON object : View

Products Affected

eaton

easysoft

CWE

CWE-522

Insufficiently Protected Credentials

CWE-256

Plaintext Storage of a Password

{"id": "CVE-2023-43777", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "CybersecurityCOE@eaton.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 1.7}]}, "published": "2023-10-17T13:15:11.827", "references": [{"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2023-1011.pdf", "tags": ["Vendor Advisory"], "source": "CybersecurityCOE@eaton.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-522"}]}, {"type": "Secondary", "source": "CybersecurityCOE@eaton.com", "description": [{"lang": "en", "value": "CWE-256"}]}], "descriptions": [{"lang": "en", "value": "Eaton easySoft software is used to program easy controllers and displays for configuring, programming and defining parameters for all the intelligent relays. This software has a password protection functionality to secure the project file from unauthorized access. This password was being stored insecurely and could be retrieved by skilled adversaries.\u00a0"}, {"lang": "es", "value": "El software Eaton easySoft se utiliza para programar controladores y pantallas f\u00e1ciles para configurar, programar y definir par\u00e1metros para todos los rel\u00e9s inteligentes. Este software tiene una funci\u00f3n de protecci\u00f3n con contrase\u00f1a para proteger el archivo del proyecto contra accesos no autorizados. Esta contrase\u00f1a se almacenaba de forma insegura y adversarios expertos pod\u00edan recuperarla."}], "lastModified": "2023-10-25T12:34:03.390", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:eaton:easysoft:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F269B5CB-F6D8-49D0-AC99-398B7FE1ABFB", "versionEndExcluding": "8.01"}], "operator": "OR"}]}], "sourceIdentifier": "CybersecurityCOE@eaton.com"}