High severity · published Jul 2, 2024
CVE-2023-41926
Insufficiently protected credentials in Kiloview P1/P2 devices
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
The webserver utilizes basic authentication for its user login to the configuration interface. As encryption is disabled on port 80, it enables potential eavesdropping on user traffic, making it possible to intercept their credentials.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
P1
P1/P2 · Kiloview
All through 4.8.2605 · source: vendor
P4
P1 4g Video Encoder Firmware · Kiloview
0 · source: CISA
P4
P2 4g Video Encoder Firmware · Kiloview
0 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-41926
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-41926
advisories.ncsc.nl
https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273
More from P1/P2
10.0
CVE-2023-41918
Missing Authentication for Critical Function in Kiloview P1/P2 devices
10.0
CVE-2023-41917
Improper input validation in Kiloview P1/P2 devices allows for remote code execution
9.8
CVE-2023-41921
Download of Code Without Integrity Check in Kiloview P1/P2 devices
9.8
CVE-2023-41920
Authentication Bypass by Primary Weakness in Kiloview P1/P2 devices
9.8
CVE-2023-41919
Use of Hard-coded Credentials in Kiloview P1/P2 devices