CVE-2023-26462

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials (usable for privilege escalation) are stored in an insecure format. (To read this stored data, the attacker needs access to the application server or its source code.)

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/238544Third Party Advisory, VDB Entry
https://thingsboard.io/docs/reference/releases/Release Notes
https://exchange.xforce.ibmcloud.com/vulnerabilities/238544Third Party Advisory, VDB Entry
https://thingsboard.io/docs/reference/releases/Release Notes

Timeline

Published: Feb 23, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-264639.8strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two different purposes wit CVE-2023-264647.5** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that CVE-2023-264656.1Pega Platform versions 7.2 to 8.8.1 are affected by an XSS issue.CVE-2023-264667.8A user with non-Admin access can change a configuration file on the client to modify the Server URL.CVE-2023-264675.4A man in the middle can redirect traffic to a malicious server in a compromised configuration.CVE-2023-264689.1Cerebrate 1.12 does not properly consider organisation_id during creation of API keys.CVE-2023-264699.8In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server.CVE-2023-26478.8A vulnerability was found in Weaver E-Office 9.5 and classified as critical. Affected by this issue is some unknown functionality of the fil CVE-2023-264707.5XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make the farm unus CVE-2023-264718.8XWiki Platform is a generic wiki platform. Starting in version 11.6-rc-1, comments are supposed to be executed with the right of superadmin CVE-2023-264728.8XWiki Platform is a generic wiki platform. Starting in version 6.2-milestone-1, one can execute any wiki content with the right of IconTheme CVE-2023-264736.5XWiki Platform is a generic wiki platform. Starting in version 1.3-rc-1, any user with edit right can execute arbitrary database select and