CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-41926 – Insufficiently protected credentials in Kiloview P1/P2 devices
https://notcve.org/view.php?id=CVE-2023-41926
02 Jul 2024 — The webserver utilizes basic authentication for its user login to the configuration interface. As encryption is disabled on port 80, it enables potential eavesdropping on user traffic, making it possible to intercept their credentials. El servidor web utiliza autenticación básica para que el usuario inicie sesión en la interfaz de configuración. Como el cifrado está deshabilitado en el puerto 80, permite posibles escuchas en el tráfico de los usuarios, lo que hace posible interceptar sus credenciales. • https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273 • CWE-522: Insufficiently Protected Credentials •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2023-41923 – Weak Password Requirements in Kiloview P1/P2 devices
https://notcve.org/view.php?id=CVE-2023-41923
02 Jul 2024 — The user management section of the web application permits the creation of user accounts with excessively weak passwords, including single-character passwords. La sección de gestión de usuarios de la aplicación web permite la creación de cuentas de usuario con contraseñas excesivamente débiles, incluidas contraseñas de un solo carácter. • https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273 • CWE-521: Weak Password Requirements •
CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 0CVE-2023-41922 – Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Kiloview P1/P2 devices
https://notcve.org/view.php?id=CVE-2023-41922
02 Jul 2024 — A 'Cross-site Scripting' (XSS) vulnerability, characterized by improper input neutralization during web page generation, has been discovered. This vulnerability allows for Stored XSS attacks to occur. Multiple areas within the administration interface of the webserver lack adequate input validation, resulting in multiple instances of Stored XSS vulnerabilities. Se ha descubierto una vulnerabilidad de 'Cross-site Scripting' (XSS), caracterizada por una neutralización inadecuada de la entrada durante la gener... • https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-41921 – Download of Code Without Integrity Check in Kiloview P1/P2 devices
https://notcve.org/view.php?id=CVE-2023-41921
02 Jul 2024 — A vulnerability allows attackers to download source code or an executable from a remote location and execute the code without sufficiently verifying the origin and integrity of the code. This vulnerability can allow attackers to modify the firmware before uploading it to the system, thus achieving the modification of the target’s integrity to achieve an insecure state. Una vulnerabilidad permite a los atacantes descargar código fuente o un ejecutable desde una ubicación remota y ejecutar el código sin verif... • https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273 • CWE-494: Download of Code Without Integrity Check •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2023-41920 – Authentication Bypass by Primary Weakness in Kiloview P1/P2 devices
https://notcve.org/view.php?id=CVE-2023-41920
02 Jul 2024 — The vulnerability allows attackers access to the root account without having to authenticate. Specifically, if the device is configured with the IP address of 10.10.10.10, the root user is automatically logged in. La vulnerabilidad permite a los atacantes acceder a la cuenta raíz sin tener que autenticarse. Específicamente, si el dispositivo está configurado con la dirección IP 10.10.10.10, el usuario root inicia sesión automáticamente. • https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273 • CWE-305: Authentication Bypass by Primary Weakness •
CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 0CVE-2023-41919 – Use of Hard-coded Credentials in Kiloview P1/P2 devices
https://notcve.org/view.php?id=CVE-2023-41919
02 Jul 2024 — Hardcoded credentials are discovered within the application's source code, creating a potential security risk for unauthorized access. Las credenciales codificadas se descubren dentro del código fuente de la aplicación, lo que crea un riesgo potencial de seguridad para el acceso no autorizado. • https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273 • CWE-798: Use of Hard-coded Credentials •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2023-41918 – Missing Authentication for Critical Function in Kiloview P1/P2 devices
https://notcve.org/view.php?id=CVE-2023-41918
02 Jul 2024 — A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated execute commands potentially leading to unauthorized data manipulation, access to privileged functions, or even the execution of arbitrary code. Una vulnerabilidad permite el acceso no autorizado a una funcionalidad inadecuadamente restringida por las ACL. Los atacantes pueden aprovechar esto para ejecutar comandos no autenticados que podrían conducir a una manipulación... • https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273 • CWE-306: Missing Authentication for Critical Function •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2023-41917 – Improper input validation in Kiloview P1/P2 devices allows for remote code execution
https://notcve.org/view.php?id=CVE-2023-41917
02 Jul 2024 — Inadequate input validation exposes the system to potential remote code execution (RCE) risks. Attackers can exploit this vulnerability by appending shell commands to the Speed-Measurement feature, enabling unauthorized code execution. Una validación de entrada inadecuada expone el sistema a posibles riesgos de ejecución remota de código (RCE). Los atacantes pueden aprovechar esta vulnerabilidad agregando comandos de shell a la función de medición de velocidad, lo que permite la ejecución de código no autor... • https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273 • CWE-20: Improper Input Validation •