CVE-2023-45220

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Android Client application, when enrolled with the define method 1(the user manually inserts the server ip address), use HTTP protocol to retrieve sensitive information (ip address and credentials to connect to a remote MQTT broker entity) instead of HTTPS and this feature is not configurable by the user.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Oct 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-452217.8Improper buffer restrictions in Intel(R) Media SDK all versions may allow an authenticated user to potentially enable escalation of privileg CVE-2023-452225.4An attacker with access to the web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-si CVE-2023-452234.3Mattermost fails to properly validate the "Show Full Name" option in a few endpoints in Mattermost Boards, allowing a member to get the full CVE-2023-452259.8Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 CVE-2023-452267.4The BIG-IP SPK TMM (Traffic Management Module) f5-debug-sidecar and f5-debug-sshd containers contains hardcoded credentials that may allow a CVE-2023-452275.4An attacker with access to the web application with vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scrip CVE-2023-452286.5The application suffers from improper access control when editing users. A user with read permissions can manipulate users, passwords, and CVE-2023-452296.5EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or IA_TA option in a DHCPv6 Advertis CVE-2023-45236.1Real Time Automation 460 Series products with versions prior to v8.9.8 are vulnerable to cross-site scripting, which could allow an attacker CVE-2023-452308.8EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in DHCPv6 client. This vulnerability c CVE-2023-452316.5EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing Neighbor Discovery Redirect message. This vu CVE-2023-452327.5EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IP