What is the CVSS score of CVE-2023-40236?

CVE-2023-40236 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.4%.

Virtual Meeting Rooms CVE-2023-40236

MEDIUM

Use of Hard-coded Credentials (CWE-798)

2023-12-25 cve@mitre.org

Authentication Bypass Virtual Meeting Rooms

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

CVE Published

Dec 25, 2023 - 06:15 nvd

MEDIUM 5.3

DescriptionNVD

In Pexip VMR self-service portal before 3, the same SSH host key is used across different customers' installations, which allows authentication bypass.

AnalysisAI

In Pexip VMR self-service portal before 3, the same SSH host key is used across different customers' installations, which allows authentication bypass. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Use of Hard-coded Credentials (CWE-798), which allows attackers to gain access using credentials embedded in source code. In Pexip VMR self-service portal before 3, the same SSH host key is used across different customers' installations, which allows authentication bypass. Affected products include: Pexip Virtual Meeting Rooms. Version information: before 3.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Remove hard-coded credentials, use environment variables or secrets management, rotate exposed credentials immediately.