CVE-2023-3243

HIGH

Honeywell Alerton BCM-WEB 3.3.X - Authentication Bypass via Session Hash Spoofing

Title source: llm
STIX 2.1

Description

** UNSUPPORTED WHEN ASSIGNED ** [An attacker can capture an authenticating hash and utilize it to create new sessions. The hash is also a poorly salted MD5 hash, which could result in a successful brute force password attack. Impacted product is BCM-WEB version 3.3.X. Recommended fix: Upgrade to a supported product such as Alerton ACM.] Out of an abundance of caution, this CVE ID is being assigned to better serve our customers and ensure all who are still running this product understand that the product is end of life and should be removed or upgraded. 

References (1)

Core 1
Core References

Scores

CVSS v3 8.3
EPSS 0.0051
EPSS Percentile 39.0%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-290 CWE-326
Status published
Products (1)
honeywell/alerton_bcm-web_firmware
Published Jun 28, 2023
Tracked Since Feb 18, 2026