VulnerabilityModified
CVE-2023-33754
The captive portal in Inpiazza Cloud WiFi versions prior to v4.2.17 does not enforce limits on the number of attempts for password recovery, allowing attackers to brute force valid user accounts to gain access to login credentials.
MEDIUM 6.5EPSS 0.66%
Does this matter?
Lower severity and a low EPSS score (0.66%). Track it; it rarely justifies an emergency change on its own.
Description
The captive portal in Inpiazza Cloud WiFi versions prior to v4.2.17 does not enforce limits on the number of attempts for password recovery, allowing attackers to brute force valid user accounts to gain access to login credentials.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.66% probability · 49th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-307
- Affected
- inpiazza/cloud wifi
- Source
- cve@mitre.org
References
- https://github.com/Alkatraz97/CVEs/blob/main/CVE-2023-33754.mdExploit, Third Party Advisory
- https://github.com/Alkatraz97/CVEs/blob/main/CVE-2023-33754.mdExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.