CVE-2023-43777 Insecure storage of password in easySoft

Medium 5.9 Published 17 Oct 2023 Updated 13 Sep 2024

Attackers can retrieve insecurely stored passwords from easySoft project files, bypassing protection and accessing sensitive configuration data.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-43777?

CVE-2023-43777 is a medium-severity vulnerability in Eaton easySoft, published on 17 Oct 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Eaton easySoft software is used to program easy controllers and displays for configuring, programming and defining parameters for all the intelligent relays. This software has a password protection functionality to secure the project file from unauthorized access. This password was being stored insecurely and could be retrieved by skilled adversaries.

Weakness: CWE-522, CWE-256

Which versions are affected by CVE-2023-43777?

It affects 1 product.

Products include Eaton Easysoft.

How do I fix CVE-2023-43777?

No fix has been published for CVE-2023-43777 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-43777 being exploited?

There is no known exploitation of CVE-2023-43777 in the wild and no public exploit code.

Sources

Also known as GHSA-m6cj-mh5r-8m7w.