CVE-2023-2759 | THREATINT

Description

A hidden API exists in TapHome's core platform before version 2023.2 that allows an authenticated, low privileged user to change passwords of other users without any prior knowledge. The attacker may gain full access to the device by using this vulnerability.

Reserved 2023-05-17 | Published 2023-07-17 | Updated 2024-10-30 | Assigner CERTVDE

HIGH: 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-863 Incorrect Authorization

Product status

Default status

unaffected

0.0 before 2023.2

affected

Credits

Noam Moshe of Claroty Research finder

References

claroty.com/team82/disclosure-dashboard/cve-2023-2759

cve.org (CVE-2023-2759)

nvd.nist.gov (CVE-2023-2759)

Download JSON

Support options

Helpdesk Chat, Email, Knowledgebase
Telegram Chat

Subscribe to our newsletter to learn more about our work.