CVE-2020-23036 Information disclosure in n/a
Attackers on public Wi-Fi can intercept authentication credentials and user passwords via man-in-the-middle attacks due to insecure session validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-23036?
CVE-2020-23036 is a medium-severity vulnerability in n/a, published on 22 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MEDIA NAVI Inc SMACom v1.2 was discovered to contain an insecure session validation vulnerability in the session handling of the `password` authentication parameter of the wifi photo transfer module. This vulnerability allows attackers with network access privileges or on public wifi networks to read the authentication credentials and follow-up requests containing the user password via a man in the middle attack.
Weakness: CWE-522
Which versions are affected by CVE-2020-23036?
It affects 1 product.
Products include Medianavi Smacom.
How do I fix CVE-2020-23036?
No fix has been published for CVE-2020-23036 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-23036 being exploited?
There is no known exploitation of CVE-2020-23036 in the wild and no public exploit code.
Sources
Also known as GHSA-722f-77g4-vmm4.