{"id":"CVE-2023-0451","aliases":["EUVD-2023-12505","GHSA-q8j4-3fxm-87xm"],"status":"published","title":"All versions of Econolite EOS traffic control software are vulnerable to CWE-284: Improper Access...","description":"Econolite EOS versions prior to 3.2.23 lack a password\nrequirement for gaining “READONLY” access to log files and certain database and\nconfiguration files. One such file contains tables with MD5 hashes and\nusernames for all defined users in the control software, including\nadministrators and technicians.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00848,"percentile":0.58366,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2023-01-26T20:37:53Z","modified":"2026-06-17T05:25:34Z","products":[{"vendor":"arista networks","product":"eos"},{"vendor":"econolite","product":"eos"}],"references":[{"url":"https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-02","tags":["government-resource","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0451"},{"url":"https://github.com/advisories/GHSA-q8j4-3fxm-87xm"}],"sources":{"cve":[{"id":"CVE-2023-0451","description":"Econolite EOS versions prior to 3.2.23 lack a password\nrequirement for gaining “READONLY” access to log files and certain database and\nconfiguration files. One such file contains tables with MD5 hashes and\nusernames for all defined users in the control software, including\nadministrators and technicians.\n\n\n\n\n\n\n\n","status":"published","published":"2023-01-26T20:37:53.38Z","modified":"2025-01-16T21:59:03.789Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:35:35.256261Z"}],"euvd":[{"id":"EUVD-2023-12505","description":"Econolite EOS versions prior to 3.2.23 lack a password\nrequirement for gaining “READONLY” access to log files and certain database and\nconfiguration files. One such file contains tables with MD5 hashes and\nusernames for all defined users in the control software, including\nadministrators and technicians.\n\n\n\n\n\n\n\n","status":"published","published":"2023-01-26T20:37:53Z","modified":"2025-01-16T21:59:03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T00:04:17.068749Z"}],"ghsa":[{"id":"GHSA-q8j4-3fxm-87xm","title":"All versions of Econolite EOS traffic control software are vulnerable to CWE-284: Improper Access...","description":"All versions of Econolite EOS traffic control software are vulnerable to CWE-284: Improper Access Control, and lack a password requirement for gaining “READONLY” access to log files, as well as certain database and configuration files. One such file contains tables with message-digest algorithm 5 (MD5) hashes and usernames for all defined users in the control software, including administrators and technicians.","status":"published","published":"2023-07-06T19:24:07Z","modified":"2024-04-04T05:31:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:56:33.286722Z"}],"nvd":[{"id":"CVE-2023-0451","description":"Econolite EOS versions prior to 3.2.23 lack a password\nrequirement for gaining “READONLY” access to log files and certain database and\nconfiguration files. One such file contains tables with MD5 hashes and\nusernames for all defined users in the control software, including\nadministrators and technicians.\n\n\n\n\n\n\n\n","status":"published","published":"2023-01-26T21:18:08.673Z","modified":"2026-06-17T05:25:34.68Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:07:46.064662Z"}]}}