CVE-2023-3243

** UNSUPPORTED WHEN ASSIGNED ** [An attacker can capture an authenticating hash and utilize it to create new sessions. The hash is also a poorly salted MD5 hash, which could result in a successful brute force password attack. Impacted product is BCM-WEB version 3.3.X. Recommended fix: Upgrade to a supported product such as Alerton ACM.] Out of an abundance of caution, this CVE ID is being assigned to better serve our customers and ensure all who are still running this product understand that the product is end of life and should be removed or upgraded.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.honeywell.com/us/en/product-security	Not Applicable

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:honeywell:alerton_bcm-web_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:honeywell:alerton_bcm-web:-:*:*:*:*:*:*:*

History

25 Apr 2024, 15:16

Type	Values Removed	Values Added
Summary	(en) UNSUPPORTED WHEN ASSIGNED [An attacker can capture an authenticating hash and utilize it to create new sessions. The hash is also a poorly salted MD5 hash, which could result in a successful brute force password attack. Impacted product is BCM-WEB version 3.3.X. Recommended fix: Upgrade to a supported product such as Alerton ACM.] Out of an abundance of caution, this CVE ID is being assigned to better serve our customers and ensure all who are still running this product understand that the product is end of life and should be removed or upgraded.	(en) UNSUPPORTED WHEN ASSIGNED [An attacker can capture an authenticating hash and utilize it to create new sessions. The hash is also a poorly salted MD5 hash, which could result in a successful brute force password attack. Impacted product is BCM-WEB version 3.3.X. Recommended fix: Upgrade to a supported product such as Alerton ACM.] Out of an abundance of caution, this CVE ID is being assigned to better serve our customers and ensure all who are still running this product understand that the product is end of life and should be removed or upgraded.

07 Nov 2023, 04:18

Type	Values Removed	Values Added
Summary	UNSUPPPORTED WHEN ASSIGNED UNSUPPORTED WHEN ASSIGNED [An attacker can capture an authenticating hash and utilize it to create new sessions. The hash is also a poorly salted MD5 hash, which could result in a successful brute force password attack. Impacted product is BCM-WEB version 3.3.X. Recommended fix: Upgrade to a supported product such as Alerton ACM.] Out of an abundance of caution, this CVE ID is being assigned to better serve our customers and ensure all who are still running this product understand that the product is end of life and should be removed or upgraded.	UNSUPPORTED WHEN ASSIGNED [An attacker can capture an authenticating hash and utilize it to create new sessions. The hash is also a poorly salted MD5 hash, which could result in a successful brute force password attack. Impacted product is BCM-WEB version 3.3.X. Recommended fix: Upgrade to a supported product such as Alerton ACM.] Out of an abundance of caution, this CVE ID is being assigned to better serve our customers and ensure all who are still running this product understand that the product is end of life and should be removed or upgraded.

11 Jul 2023, 17:42

Type	Values Removed	Values Added
CWE		NVD-CWE-noinfo
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.8
CPE		cpe:2.3:h:honeywell:alerton_bcm-web:-:::::::* cpe:2.3:o:honeywell:alerton_bcm-web_firmware:-:::::::*
First Time		Honeywell alerton Bcm-web Firmware Honeywell Honeywell alerton Bcm-web
References	~~(MISC) https://www.honeywell.com/us/en/product-security -~~	(MISC) https://www.honeywell.com/us/en/product-security - Not Applicable

07 Jul 2023, 14:15

Type	Values Removed	Values Added
Summary	UNSUPPPORTED WHEN ASSIGNED UNSUPPORTED WHEN ASSIGNED [An attacker can capture an authenticating hash and utilize it to create new sessions. The hash is also a poorly salted MD5 hash, which could result in a successful brute force password attack. Recommended fix: Upgrade to a supported product such as Alerton ACM.] Out of an abundance of caution, this CVE ID is being assigned to better serve our customers and ensure all who are still running this product understand that the product is end of life and should be removed or upgraded.	UNSUPPPORTED WHEN ASSIGNED UNSUPPORTED WHEN ASSIGNED [An attacker can capture an authenticating hash and utilize it to create new sessions. The hash is also a poorly salted MD5 hash, which could result in a successful brute force password attack. Impacted product is BCM-WEB version 3.3.X. Recommended fix: Upgrade to a supported product such as Alerton ACM.] Out of an abundance of caution, this CVE ID is being assigned to better serve our customers and ensure all who are still running this product understand that the product is end of life and should be removed or upgraded.

28 Jun 2023, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-06-28 21:15

Updated : 2024-04-25 15:16

NVD link : CVE-2023-3243

Mitre link : CVE-2023-3243

CVE.ORG link : CVE-2023-3243

JSON object : View

Products Affected

honeywell

alerton_bcm-web
alerton_bcm-web_firmware

CWE

NVD-CWE-noinfo CWE-290

Authentication Bypass by Spoofing

CWE-326

Inadequate Encryption Strength

9.8 /10