SB2024012408 - Weak Encoding for Password in Lantronix XPort Device Server Configuration Manager
Published: January 24, 2024
Security Bulletin ID
SB2024012408
Severity
Low
Patch available
NO
Number of vulnerabilities
1
Exploitation vector
Adjecent network
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Weak Encoding for Password (CVE-ID: CVE-2023-7237)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the affected application sends weakly encoded credentials within web request headers. A remote attacker on the local network can intercept the traffic and retrieve the credentials from another user.
Remediation
Cybersecurity Help is not aware of any official remediation provided by the vendor.