CVE-2023-40707
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
The built-in web server of SNAP PAC S1 Firmware version R10.3b does not require setting a complex password, which could allow for a successful brute force attack if users do not configure complex credentials.
Risk Assessment
The lack of password complexity requirements increases the risk of unauthorized access to the system, potentially leading to serious security breaches.
Recommendation
It is recommended to implement a policy enforcing the use of complex passwords for all users of the web server.
Other vulnerabilities in SNAP PAC S1 Firmware version R10.3b
See all- CVE-2023-40710Medium
An adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller has the built-in web server enabled but is not fully configured for SNAP PAC S1 Firmware version R10.3b.
- CVE-2023-40709Medium
An adversary could crash the entire device by sending a large quantity of ICMP requests if the controller has the built-in web server enabled but is not fully configured for SNAP PAC S1 Firmware version R10.3b.
- CVE-2023-40708Medium
The FTP port is open by default in SNAP PAC S1 Firmware version R10.3b, which could allow unauthorized users to access some device files.
- CVE-2023-40706High
The web server for SNAP PAC S1 Firmware version R10.3b has no limit on the number of login attempts. This could allow for a brute-force attack on the built-in web server login.
Original NVD description (English source)
There are no requirements for setting a complex password in the built-in web server of the SNAP PAC S1 Firmware version R10.3b, which could allow for a successful brute force attack if users don't set up complex credentials.