CVE-2023-45194 Hardcoded credentials in MR-GM2
An attacker can intercept wireless communications if the device retains factory-default pre-shared keys, requiring users to change these credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-45194?
CVE-2023-45194 is a medium-severity vulnerability in Micro Research Ltd. MR-GM2, published on 11 Oct 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Use of default credentials vulnerability in MR-GM2 firmware Ver. 3.00.03 and earlier, and MR-GM3 (-D/-K/-S/-DK/-DKS/-M/-W) firmware Ver. 1.03.45 and earlier allows a network-adjacent unauthenticated attacker to intercept wireless LAN communication, when the affected product performs the communication without changing the pre-shared key from the factory-default configuration.
Weakness: CWE-798
Which versions are affected by CVE-2023-45194?
It affects 7 products.
Products include Mrl Mr-Gm2 Firmware, Mrl Mr-Gm3-D Firmware, Mrl Mr-Gm3-Dks Firmware, Mrl Mr-Gm3-K Firmware, Mrl Mr-Gm3-M Firmware, Mrl Mr-Gm3-S Firmware and 1 more.
How do I fix CVE-2023-45194?
No fix has been published for CVE-2023-45194 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-45194 being exploited?
There is no known exploitation of CVE-2023-45194 in the wild and no public exploit code.
Sources
Also known as GHSA-h49v-gcm2-4fm3.