What is the CVSS score of CVE-2023-43757?

CVE-2023-43757 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Wrc 2533Ghbk2 T Firmware CVE-2023-43757

MEDIUM

Inadequate Encryption Strength (CWE-326)

2023-11-16 vultures@jpcert.or.jp

Information Disclosure Wrc 2533Ghbk2 T Firmware Wrc 2533Ghbk I Firmware Wrc 1750Ghbk2 I Firmware Wrc 1750Ghbk E Firmware Wrc 1750Ghbk Firmware Wrc 1167Ghbk2 Firmware Wrc 1167Ghbk Firmware Wrc F1167Acf Firmware Wrc 733Ghbk Firmware Wrc 733Ghbk I Firmware Wrc 733Ghbk C Firmware Wrc 300Ghbk2 I Firmware Wrc 300Ghbk Firmware Wrc 733Febk Firmware Wrc 300Febk Firmware Wrc F300Nf Firmware Wrh 300Wh H Firmware Wrh 300Bk Firmware Wrh 300Wh Firmware Wrh 300Rd Firmware Wrh 300Sv Firmware Wrh 300Bk S Firmware Wrh 300Wh S Firmware Wrh 300Bk2 S Firmware Wrh 300Wh2 S Firmware Wrh H300Bk Firmware Wrh H300Wh Firmware Wrh 150Bk Firmware Wrh 150Wh Firmware Lan W300N Rs Firmware Lan W301Nr Firmware Lan W300N P Firmware Lan Wh300N Dgp Firmware Lan Wh300Ndgpe Firmware

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Nov 16, 2023 - 07:15 nvd

MEDIUM 6.5

DescriptionNVD

Inadequate encryption strength vulnerability in multiple routers provided by ELECOM CO.,LTD. and LOGITEC CORPORATION allows a network-adjacent unauthenticated attacker to guess the encryption key used for wireless LAN communication and intercept the communication. As for the affected products/versions, see the information provided by the vendor under [References] section.

AnalysisAI

Inadequate encryption strength vulnerability in multiple routers provided by ELECOM CO.,LTD. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-326. Inadequate encryption strength vulnerability in multiple routers provided by ELECOM CO.,LTD. and LOGITEC CORPORATION allows a network-adjacent unauthenticated attacker to guess the encryption key used for wireless LAN communication and intercept the communication. As for the affected products/versions, see the information provided by the vendor under [References] section. Affected products include: Elecom Wrc-2533Ghbk2-T Firmware, Elecom Wrc-2533Ghbk-I Firmware, Elecom Wrc-1750Ghbk2-I Firmware, Elecom Wrc-1750Ghbk-E Firmware, Elecom Wrc-1750Ghbk Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.