CVE-2023-33754
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
The captive portal in Inpiazza Cloud WiFi versions prior to v4.2.17 does not enforce limits on the number of attempts for password recovery, allowing attackers to brute force valid user accounts to gain access to login credentials.
Risk Assessment
The lack of limits on password recovery attempts increases the risk of unauthorized access to user accounts, potentially leading to data breaches and security violations for the organization.
Recommendation
It is recommended to upgrade to Inpiazza Cloud WiFi version v4.2.17 or later to implement appropriate limits on the password recovery process.
Original NVD description (English source)
The captive portal in Inpiazza Cloud WiFi versions prior to v4.2.17 does not enforce limits on the number of attempts for password recovery, allowing attackers to brute force valid user accounts to gain access to login credentials.