CVE-2023-40706
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
The web server for SNAP PAC S1 Firmware version R10.3b has no limit on the number of login attempts. This could allow for a brute-force attack on the built-in web server login.
Risk Assessment
The lack of a login attempt limit increases the risk of a successful attack, potentially leading to unauthorized access to the system.
Recommendation
It is recommended to implement a limit on login attempts and to monitor failed attempts to minimize the risk of brute-force attacks.
Other vulnerabilities in SNAP PAC S1 Firmware version R10.3b
See all- CVE-2023-40710Medium
An adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller has the built-in web server enabled but is not fully configured for SNAP PAC S1 Firmware version R10.3b.
- CVE-2023-40709Medium
An adversary could crash the entire device by sending a large quantity of ICMP requests if the controller has the built-in web server enabled but is not fully configured for SNAP PAC S1 Firmware version R10.3b.
- CVE-2023-40708Medium
The FTP port is open by default in SNAP PAC S1 Firmware version R10.3b, which could allow unauthorized users to access some device files.
- CVE-2023-40707High
The built-in web server of SNAP PAC S1 Firmware version R10.3b does not require setting a complex password, which could allow for a successful brute force attack if users do not configure complex credentials.
Original NVD description (English source)
There is no limit on the number of login attempts in the web server for the SNAP PAC S1 Firmware version R10.3b. This could allow for a brute-force attack on the built-in web server login.