CVE-2023-33373

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Connected IO v2.1.0 and prior keeps passwords and credentials in clear-text format, allowing attackers to exfiltrate the credentials and use them to impersonate the devices.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-312

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
connectedio	connected_io	2.1.0

References

https://claroty.com/team82/disclosure-dashboard/cve-2023-33373Third Party Advisory
https://www.connectedio.com/products/routersProduct
https://claroty.com/team82/disclosure-dashboard/cve-2023-33373Third Party Advisory
https://www.connectedio.com/products/routersProduct

Timeline

Published: Aug 4, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-333749.8Connected IO v2.1.0 and prior has a command as part of its communication protocol allowing the management platform to specify arbitrary OS c CVE-2023-333759.8Connected IO v2.1.0 and prior has a stack-based buffer overflow vulnerability in its communication protocol, enabling attackers to take cont CVE-2023-333769.8Connected IO v2.1.0 and prior has an argument injection vulnerability in its iptables command message in its communication protocol, enablin CVE-2023-333779.8Connected IO v2.1.0 and prior has an OS command injection vulnerability in the set firewall command in part of its communication protocol, e CVE-2023-333789.8Connected IO v2.1.0 and prior has an argument injection vulnerability in its AT command message in its communication protocol, enabling atta CVE-2023-333799.8Connected IO v2.1.0 and prior has a misconfiguration in their MQTT broker used for management and device communication, which allows devices CVE-2023-33386.5A null pointer dereference flaw was found in the Linux kernel's DECnet networking protocol. This issue could allow a remote user to crash th CVE-2023-333817.2A command injection vulnerability was found in the ping functionality of the MitraStar GPT-2741GNAC router (firmware version AR_g5.8_110WVN0 CVE-2023-333835.3Shelly 4PM Pro four-channel smart switch 0.11.0 allows an attacker to trigger a BLE out of bounds read fault condition that results in a dev CVE-2023-333869.8MarsCTF 1.2.1 has an arbitrary file upload vulnerability in the interface for uploading attachments in the background.CVE-2023-333876.1A reflected cross-site scripting (XSS) vulnerability in DATEV eG Personal-Management System Comfort/Comfort Plus v15.1.0 to v16.1.1 P4 allow CVE-2023-33397.5A vulnerability has been found in code-projects Agro-School Management System 1.0 and classified as critical. Affected by this vulnerability