M Bus 900S Firmware
CVE-2023-34433
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
PiiGAB M-Bus stores passwords using a weak hash algorithm.
AnalysisAI
PiiGAB M-Bus stores passwords using a weak hash algorithm. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-916. Affected products include: Piigab M-Bus 900S Firmware.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in M Bus 900S Firmware
View allThere are no requirements for setting a complex password for PiiGAB M-Bus, which could contribute to a successful brute
PiiGAB M-Bus SoftwarePack 900S does not correctly sanitize user input, which could allow an attacker to inject arbitrary
PiiGAB M-Bus contains hard-coded credentials which it uses for authentication. Rated critical severity (CVSS 9.8), this
The number of login attempts is not limited. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
PiiGAB M-Bus is vulnerable to cross-site request forgery. Rated high severity (CVSS 8.8), this vulnerability is remotely
PiiGAB M-Bus transmits credentials in plaintext format. Rated high severity (CVSS 7.5), this vulnerability is remotely e
PiiGAB M-Bus stores credentials in a plaintext file, which could allow a low-level user to gain admin credentials. Rated
PiiGAB M-Bus does not validate identification strings before processing, which could make it vulnerable to cross-site sc
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today