VulnerabilityModified

CVE-2023-25437

An issue was discovered in vTech VCS754 version 1.1.1.A before 1.1.1.H, allows attackers to gain escalated privileges and gain sensitive information due to cleartext passwords passed in the raw HTML.

HIGH 8.8EPSS 14.1%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 14.1%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.

Description

An issue was discovered in vTech VCS754 version 1.1.1.A before 1.1.1.H, allows attackers to gain escalated privileges and gain sensitive information due to cleartext passwords passed in the raw HTML.

CVSS 3.1: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 14.11% probability · 96th percentile
CISA KEV: Not listed
Weakness: CWE-319
Affected: vtech/vcs754a firmware
Source: cve@mitre.org

References

https://i.imgur.com/aDuiY8q.pngExploit
https://yechiel.xyz/vulnerability-in-vtechs-vcs754a-business-phones-exposes-sip-credentialsThird Party Advisory
https://i.imgur.com/aDuiY8q.pngExploit
https://yechiel.xyz/vulnerability-in-vtechs-vcs754a-business-phones-exposes-sip-credentialsThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.