CVE-2023-50127

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Hozard alarm system (Alarmsysteem) v1.0 is vulnerable to Improper Authentication. Commands sent via the SMS functionality are accepted from random phone numbers, which allows an attacker to bring the alarm system to a disarmed state from any given phone number.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.secura.com/services/iot/consumer-products/security-concerns-in-popular-smart-home-devicesExploit, Third Party Advisory
https://www.secura.com/services/iot/consumer-products/security-concerns-in-popular-smart-home-devicesExploit, Third Party Advisory

Timeline

Published: Jan 11, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-501285.3The remote keyless system of the Hozard alarm system (alarmsystemen) v1.0 sends an identical radio frequency signal for each request, which CVE-2023-501296.5Missing encryption in the NFC tags of the Flient Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proximity t CVE-2023-50135.4A vulnerability has been found in Pluck CMS 4.7.18 and classified as problematic. This vulnerability affects unknown code of the file instal CVE-2023-501365.4Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the name field when creating a new cu CVE-2023-501375.4JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office.CVE-2023-50149.8A vulnerability was found in Sakshi2610 Food Ordering Website 1.0 and classified as critical. This issue affects some unknown processing of CVE-2023-501479.8There is an arbitrary command execution vulnerability in the setDiagnosisCfg function of the cstecgi .cgi of the TOTOlink A3700R router devi CVE-2023-50156.1A vulnerability was found in UCMS 1.4.7. It has been classified as problematic. Affected is an unknown function of the file ajax.php?do=stra CVE-2023-501598.8In ScaleFusion (Windows Desktop App) agent 10.5.2, Kiosk mode application restrictions can be bypassed allowing arbitrary code to be execute CVE-2023-50169.8A vulnerability was found in spider-flow up to 0.5.0. It has been declared as critical. Affected by this vulnerability is the function Drive CVE-2023-501627.2SQL injection vulnerability in EmpireCMS v7.5, allows remote attackers to execute arbitrary code and obtain sensitive information via the Do CVE-2023-501649.8An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious