{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-35835", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-08-02T16:30:45.385Z", "dateReserved": "2023-06-18T00:00:00", "datePublished": "2024-01-23T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-01-23T22:39:07.573677"}, "descriptions": [{"lang": "en", "value": "An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02. The device provides a WiFi access point for initial configuration. The WiFi network provided has no network authentication (such as an encryption key) and persists permanently, including after enrollment and setup is complete. The WiFi network serves a web-based configuration utility, as well as an unauthenticated ModBus protocol interface."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://yougottahackthat.com/blog/"}, {"url": "https://www.solaxpower.com/help/upgrading-the-pocket-wifi-firmware/"}, {"url": "https://www.solaxpower.com/downloads/"}, {"url": "https://yougottahackthat.com/blog/1370/solax-inverters-pocket-wifi-using-poor-authentication"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T16:30:45.385Z"}, "title": "CVE Program Container", "references": [{"url": "https://yougottahackthat.com/blog/", "tags": ["x_transferred"]}, {"url": "https://www.solaxpower.com/help/upgrading-the-pocket-wifi-firmware/", "tags": ["x_transferred"]}, {"url": "https://www.solaxpower.com/downloads/", "tags": ["x_transferred"]}, {"url": "https://yougottahackthat.com/blog/1370/solax-inverters-pocket-wifi-using-poor-authentication", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:solax:pocket_wifi_3_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "FAA04768-4E31-414A-A19C-855B1E1D8CCE", "versionEndIncluding": "3.009.03_20230504", "versionStartIncluding": "3.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:solax:pocket_wifi_3:-:*:*:*:*:*:*:*", "matchCriteriaId": "112442CA-E44E-4C2B-95C3-9162E56B9F16", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02. The device provides a WiFi access point for initial configuration. The WiFi network provided has no network authentication (such as an encryption key) and persists permanently, including after enrollment and setup is complete. The WiFi network serves a web-based configuration utility, as well as an unauthenticated ModBus protocol interface."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en SolaX Pocket WiFi 3 hasta 3.001.02. El dispositivo proporciona un punto de acceso WiFi para la configuraci\u00f3n inicial. La red WiFi proporcionada no tiene autenticaci\u00f3n de red (como una clave de cifrado) y persiste permanentemente, incluso despu\u00e9s de que se completa el registro y la configuraci\u00f3n. La red WiFi sirve una utilidad de configuraci\u00f3n basada en web, as\u00ed como una interfaz de protocolo ModBus no autenticada."}], "id": "CVE-2023-35835", "lastModified": "2024-02-06T14:23:41.733", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-01-23T23:15:07.947", "references": [{"source": "cve@mitre.org", "tags": ["Not Applicable"], "url": "https://www.solaxpower.com/downloads/"}, {"source": "cve@mitre.org", "tags": ["Not Applicable"], "url": "https://www.solaxpower.com/help/upgrading-the-pocket-wifi-firmware/"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://yougottahackthat.com/blog/"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://yougottahackthat.com/blog/1370/solax-inverters-pocket-wifi-using-poor-authentication"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}