CVE-2023-33868 PiiGAB M-Bus Improper Restriction of Excessive Authentication Attempts

Medium 5.9 Published 6 Jul 2023 Updated 24 Oct 2024

Attackers can brute force HTTP basic authentication due to missing login attempt limits, potentially gaining unauthorized access to the system.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-33868?

CVE-2023-33868 is a medium-severity authentication bypass vulnerability in PiiGAB M-Bus SoftwarePack, published on 6 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The number of login attempts is not limited. This could allow an attacker to perform a brute force on HTTP basic authentication.

Weakness: CWE-307

Which versions are affected by CVE-2023-33868?

It affects 1 product.

Products include Piigab M-Bus 900s Firmware.

How do I fix CVE-2023-33868?

No fix has been published for CVE-2023-33868 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2023-33868 being exploited?

There is no known exploitation of CVE-2023-33868 in the wild and no public exploit code.

Sources

Also known as GHSA-vvgv-54pp-4xr8.