VulnerabilityModified

CVE-2023-41353

Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of weak password requirements.

HIGH 8.8EPSS 0.55%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.55%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of weak password requirements. A remote attacker with regular user privilege can easily infer the administrator password from system information after logging system, resulting in admin access and performing arbitrary system operations or disrupt service.

CVSS 3.1: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.55% probability · 44th percentile
CISA KEV: Not listed
Weakness: CWE-521
Affected: nokia/g-040w-q firmware
Source: twcert@cert.org.tw

References

https://www.twcert.org.tw/tw/cp-132-7503-a27ed-1.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-7503-a27ed-1.htmlThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.