CVE-2023-3243

HIGH

Honeywell Alerton Bcm-web Firmware - Authentication Bypass by Spoofing

Title source: rule
STIX 2.1

Description

** UNSUPPORTED WHEN ASSIGNED ** [An attacker can capture an authenticating hash and utilize it to create new sessions. The hash is also a poorly salted MD5 hash, which could result in a successful brute force password attack. Impacted product is BCM-WEB version 3.3.X. Recommended fix: Upgrade to a supported product such as Alerton ACM.] Out of an abundance of caution, this CVE ID is being assigned to better serve our customers and ensure all who are still running this product understand that the product is end of life and should be removed or upgraded. 

Scores

CVSS v3 8.3
EPSS 0.0011
EPSS Percentile 29.6%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-290 CWE-326
Status published
Products (1)
honeywell/alerton_bcm-web_firmware
Published Jun 28, 2023
Tracked Since Feb 18, 2026