Critical severity · published Nov 6, 2023
CVE-2023-5777
Weintek EasyBuilder Pro Use of Hard-coded Credentials
9.8
CVSS
0.5%
EPSS
No
On KEV
Description
Weintek EasyBuilder Pro contains a vulnerability that, even when the private key is immediately deleted after the crash report transmission is finished, the private key is exposed to the public, which could result in obtaining remote control of the crash report server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EP
EasyBuilder Pro · Weintek
before v6.07.02; through 6.08.01.592; through 6.08.02.470 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-5777
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-5777
Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-05
More from EasyBuilder Pro
7.8
CVE-2023-0104
The listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by decompiling a malicious project file