CVE-2023-45194 - OpenCVE

Use of default credentials vulnerability in MR-GM2 firmware Ver. 3.00.03 and earlier, and MR-GM3 (-D/-K/-S/-DK/-DKS/-M/-W) firmware Ver. 1.03.45 and earlier allows a network-adjacent unauthenticated attacker to intercept wireless LAN communication, when the affected product performs the communication without changing the pre-shared key from the factory-default configuration.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Mrl	Mr-gm2 Mr-gm2 Firmware Mr-gm3-d Mr-gm3-d Firmware Mr-gm3-dks Mr-gm3-dks Firmware Mr-gm3-k Mr-gm3-k Firmware Mr-gm3-m Mr-gm3-m Firmware Mr-gm3-s Mr-gm3-s Firmware Mr-gm3-w Mr-gm3-w Firmware

Configuration 1 [-]

AND

cpe:2.3:o:mrl:mr-gm3-d_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mrl:mr-gm3-d:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:mrl:mr-gm3-k_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mrl:mr-gm3-k:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:mrl:mr-gm3-s_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mrl:mr-gm3-s:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:mrl:mr-gm3-dks_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mrl:mr-gm3-dks:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:mrl:mr-gm3-m_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mrl:mr-gm3-m:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:mrl:mr-gm2_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mrl:mr-gm2:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND

cpe:2.3:o:mrl:mr-gm3-w_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mrl:mr-gm3-w:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://jvn.jp/en/vu/JVNVU99039725/
https://www.mrl.co.jp/20231005_security/

History

Wed, 18 Sep 2024 19:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: jpcert

Published: 2023-10-11T00:12:54.320Z

Updated: 2024-09-18T18:12:54.973Z

Reserved: 2023-10-05T02:27:26.616Z

Link: CVE-2023-45194

Vulnrichment

Updated: 2024-08-02T20:14:19.930Z

NVD

Status : Analyzed

Published: 2023-10-11T01:15:08.837

Modified: 2023-10-31T18:08:52.140

Link: CVE-2023-45194

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mrl:mr-gm3-d_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "1726D73D-B4B1-48FC-A9B7-3E7AF28D0B3B", "versionEndExcluding": "1.04.00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mrl:mr-gm3-d:-:*:*:*:*:*:*:*", "matchCriteriaId": "BF17D8F8-FC31-4347-BA96-EF4D045C1137", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mrl:mr-gm3-k_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "6CA08A4E-55AF-4D93-AF24-2AD07FABB240", "versionEndExcluding": "1.04.00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mrl:mr-gm3-k:-:*:*:*:*:*:*:*", "matchCriteriaId": "3569FBAB-96FD-429E-9B7D-B649B72000FB", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mrl:mr-gm3-s_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "FD9946EF-FC18-4BB3-8106-2E21E1A76348", "versionEndExcluding": "1.04.00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mrl:mr-gm3-s:-:*:*:*:*:*:*:*", "matchCriteriaId": "A4254C71-AED3-4742-B729-F774AD6B8488", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mrl:mr-gm3-dks_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "6209AA44-C988-461A-B414-DB52D6D2585C", "versionEndExcluding": "1.04.00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mrl:mr-gm3-dks:-:*:*:*:*:*:*:*", "matchCriteriaId": "C28E168A-0909-4F45-8F7B-F4794B1ACCA6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mrl:mr-gm3-m_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "2EBAF1A9-236D-4705-A48A-5A3D314AB5F6", "versionEndExcluding": "1.04.00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mrl:mr-gm3-m:-:*:*:*:*:*:*:*", "matchCriteriaId": "737E83DE-5093-4CD8-BBE9-74501AC4FD3E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mrl:mr-gm2_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "BC11B5A2-ED94-4120-AE8F-4F7DD8D71AAB", "versionEndExcluding": "3.01.00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mrl:mr-gm2:-:*:*:*:*:*:*:*", "matchCriteriaId": "ED3DDF43-3F12-4089-8601-900E2D9B81CB", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mrl:mr-gm3-w_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "61E94B12-55B5-4600-A00C-E22576907C84", "versionEndExcluding": "1.04.00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mrl:mr-gm3-w:-:*:*:*:*:*:*:*", "matchCriteriaId": "BBA48838-60EB-4FF8-8C91-48F176550553", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Use of default credentials vulnerability in MR-GM2 firmware Ver. 3.00.03 and earlier, and MR-GM3 (-D/-K/-S/-DK/-DKS/-M/-W) firmware Ver. 1.03.45 and earlier allows a network-adjacent unauthenticated attacker to intercept wireless LAN communication, when the affected product performs the communication without changing the pre-shared key from the factory-default configuration."}, {"lang": "es", "value": "Vulnerabilidad del uso de credenciales predeterminadas en la versi\u00f3n del firmware MR-GM2. 3.00.03 y anteriores, y firmware MR-GM3 (-D/-K/-S/-DK/-DKS/-M/-W) versi\u00f3n 1.03.45 y anteriores, permiten que un atacante no autenticado adyacente a la red intercepte la comunicaci\u00f3n LAN inal\u00e1mbrica, cuando el producto afectado realiza la comunicaci\u00f3n sin cambiar la clave precompartida de la configuraci\u00f3n predeterminada de f\u00e1brica."}], "id": "CVE-2023-45194", "lastModified": "2023-10-31T18:08:52.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-10-11T01:15:08.837", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/vu/JVNVU99039725/"}, {"source": "vultures@jpcert.or.jp", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.mrl.co.jp/20231005_security/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-798"}], "source": "nvd@nist.gov", "type": "Primary"}]}