CVE-2023-33468 Auth bypass in n/a
Attackers can remotely extract connection codes to bypass authentication and manipulate KramerAV VIA devices without physical access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-33468?
CVE-2023-33468 is a critical authentication bypass vulnerability in n/a, published on 9 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
KramerAV VIA Connect (2) and VIA Go (2) devices with a version prior to 4.0.1.1326 exhibit a vulnerability that enables remote manipulation of the device. This vulnerability involves extracting the connection confirmation code remotely, bypassing the need to obtain it directly from the physical screen.
Weakness: CWE-863
Which versions are affected by CVE-2023-33468?
It affects 2 products.
Products include Kramerav via Connect2 Firmware, Kramerav via Go2 Firmware.
How do I fix CVE-2023-33468?
No fix has been published for CVE-2023-33468 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-33468 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-33468 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-jgwh-r9rp-8372.