CVE-2022-43377 — Improper Restriction of Excessive Authentication Attempts in Netbotz 355 Firmware

CWE-307 — Improper Restriction of Excessive Authentication Attempts3 documents3 sources

Severity

7.5HIGHNVD

EPSS

0.4%

top 40.74%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Schneider-electric Netbotz 355 Firmware Schneider-electric Netbotz 450 Firmware Schneider-electric Netbotz 455 Firmware +3 more

Timeline

PublishedApr 18

Latest updateJul 6

Description

A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover when a brute force attack is performed on the account. Affected Products: NetBotz 4 - 355/450/455/550/570 (V4.7.0 and prior)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages6 packages

▶NVDschneider-electric/netbotz_355_firmware4.0.0 — 4.7.0

▶NVDschneider-electric/netbotz_450_firmware4.0.0 — 4.7.0

▶NVDschneider-electric/netbotz_455_firmware4.0.0 — 4.7.0

▶NVDschneider-electric/netbotz_550_firmware4.0.0 — 4.7.0

▶NVDschneider-electric/netbotz_570_firmware4.0.0 — 4.7.0

Patches

Patch: download.schneider-electric.com ↗Patch: download.schneider-electric.com ↗

🔴Vulnerability Details

GHSA

GHSA-j893-r6jv-55xv: A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover when a brute force attack↗2023-07-06

▶

CVEList

CVE-2022-43377: A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover when a brute force attack↗2023-04-18

▶