CVE-2023-0353

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Akuvox E11 uses a weak encryption algorithm for stored passwords and uses a hard-coded password for decryption which could allow the encrypted passwords to be decrypted from the configuration file.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Akuvox	E11	All

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01Third Party Advisory, US Government Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01Third Party Advisory, US Government Resource

Timeline

Published: Mar 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-03549.1The Akuvox E11 web server can be accessed without any user authentication, and this could allow an attacker to access sensitive information,CVE-2023-03557.5Akuvox E11 uses a hard-coded cryptographic key, which could allow an attacker to decrypt sensitive information.CVE-2023-03567.5SOCOMEC MODULYS GP Netvision versions 7.20 and prior lack strong encryption for credentials on HTTP connections, which could result in threa CVE-2023-03576.1Helpy version 2.8.0 allows an unauthenticated remote attacker to exploit an XSS stored in the application. This is possible because the appl CVE-2023-03587.8Use After Free in GitHub repository gpac/gpac prior to 2.3.0-DEV.CVE-2023-03597.5A missing nullptr-check in handle_ra_input can cause a nullptr-deref.CVE-2023-03605.4The Location Weather WordPress plugin before 1.3.4 does not validate and escape some of its block options before outputting them back in a p CVE-2023-03617.4A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to rec CVE-2023-03625.4Themify Portfolio Post WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputting them ba CVE-2023-03635.4The Scheduled Announcements Widget WordPress plugin before 1.0 does not validate and escape some of its shortcode attributes before outputti CVE-2023-03645.4The real.Kit WordPress plugin before 5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a pa CVE-2023-03655.4The React Webcam WordPress plugin through 1.2.0 does not validate and escape some of its shortcode attributes before outputting them back in