CVE-2023-33754 Auth bypass in n/a
Attackers can brute force password recovery attempts in the captive portal to gain valid user login credentials.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-33754?
CVE-2023-33754 is a medium-severity authentication bypass vulnerability in n/a, published on 1 Jun 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The captive portal in Inpiazza Cloud WiFi versions prior to v4.2.17 does not enforce limits on the number of attempts for password recovery, allowing attackers to brute force valid user accounts to gain access to login credentials.
Weakness: CWE-307
Which versions are affected by CVE-2023-33754?
It affects 1 product.
Products include Inpiazza Cloud Wifi.
How do I fix CVE-2023-33754?
No fix has been published for CVE-2023-33754 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-33754 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-33754 exists.
Sources
Also known as GHSA-9jw5-jrmv-gmvg.