CVE-2023-0352: Critical severity akuvox e11 firmware vulnerability

Published Mar 13, 2023

Updated

The Akuvox E11 password recovery webpage can be accessed without authentication, and an attacker could download the device key file. An attacker could then use this page to reset the password back to the default.

Affected Software

3 affected components

Akuvox E11

Akuvox E11 Firmware

Akuvox E11

Event History

Mar 13, 2023

CVE Published

via MITRE·08:15 PM

Data Sourced

via MITRE·08:15 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

ICSA-23-068-01

Frequently Asked Questions

What is the severity of CVE-2023-0352?

CVE-2023-0352 is considered a critical vulnerability due to its potential for unauthorized access to sensitive device functions.

How do I fix CVE-2023-0352?

To mitigate CVE-2023-0352, restrict access to the password recovery webpage through network firewall rules or by updating firmware if available.

What systems are affected by CVE-2023-0352?

CVE-2023-0352 affects the Akuvox E11 series devices running the vulnerable firmware version.

Can CVE-2023-0352 be exploited remotely?

Yes, an attacker can exploit CVE-2023-0352 remotely, gaining unauthorized access to the password recovery functionality.

What are the potential consequences of CVE-2023-0352?

If exploited, CVE-2023-0352 could allow an attacker to reset the device password to default, compromising device security.