CVE-2023-33468

CriticalCVSS 9.1/10Last modified Jul 9, 2026

Description

KramerAV VIA Connect (2) and VIA Go (2) devices with a version prior to 4.0.1.1326 exhibit a vulnerability that enables remote manipulation of the device. This vulnerability involves extracting the connection confirmation code remotely, bypassing the need to obtain it directly from the physical screen.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
kramerav	via_connect2	< 4.0.1.1326
kramerav	via_go2	< 4.0.1.1326

References

https://github.com/Sharpe-nl/CVEs/tree/main/CVE-2023-33468Exploit, Third Party Advisory
https://github.com/Sharpe-nl/CVEs/tree/main/CVE-2023-33468Exploit, Third Party Advisory

Timeline

Published: Aug 9, 2023
Last modified: Jul 9, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-334697.8In instances where the screen is visible and remote mouse connection is enabled, KramerAV VIA Connect (2) and VIA Go (2) devices with a vers CVE-2023-33475.9A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server s CVE-2023-334728.8An issue was discovered in Scada-LTS v2.7.5.2 build 4551883606 and before, allows remote attackers with low-level authentication to escalate CVE-2023-334769.8ReadyMedia (MiniDLNA) versions from 1.1.15 up to 1.3.2 is vulnerable to Buffer Overflow. The vulnerability is caused by incorrect validation CVE-2023-334776.5In Harmonic NSG 9000-6G devices, an authenticated remote user can obtain source code by directly requesting a special path.CVE-2023-334789.8RemoteClinic 2.0 has a SQL injection vulnerability in the ID parameter of /medicines/stocks.php.CVE-2023-334799.8RemoteClinic version 2.0 contains a SQL injection vulnerability in the /staff/edit.php file.CVE-2023-33485.7The Wrangler command line tool (<=wrangler@3.1.0 or <=wrangler@2.20.1) was affected by a directory traversal vulnerability when running a l CVE-2023-334808.8RemoteClinic 2.0 contains a critical vulnerability chain that can be exploited by a remote attacker with low-privileged user credentials to CVE-2023-334819.8RemoteClinic 2.0 is vulnerable to a time-based blind SQL injection attack in the 'start' GET parameter of patients/index.php.CVE-2023-334858.8TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contains a post-authentication buffer overflow via parameter sPort/ePort i CVE-2023-334869.8TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setOpModeCfg. This vulnerabil