CVE-2023-35837

Katalog CVE

CVSS 9.8 · Critical EPSS 0,98%

Kerentanan pada solax pocket wifi 3 firmware. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02. Authentication for web interface is completed via an unauthenticated WiFi AP. The administrative password for the web interface has a default password, equal to the registration ID of the device. This same registration ID is used as the WiFi SSID name. No routine is in place to force a change to this password on first use or bring its default state to the attention of the user. Once authenticated, an attacker can reconfigure the device or upload new firmware, both of which can lead to Denial of Service, code execution, or Escalation of Privileges.

Rincian

Terbit di NVD

23 Januari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

EPSS (30 hari)

0,98% peluang dieksploitasi; lebih tinggi dari 61,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://yougottahackthat.com/blog/ advisory pihak ketiga
• https://yougottahackthat.com/blog/1370/solax-inverters-pocket-wifi-using-poor-authentication advisory pihak ketiga
• https://www.solaxpower.com/downloads/ not applicable
• https://www.solaxpower.com/help/upgrading-the-pocket-wifi-firmware/ product