{"id":"CVE-2023-45194","aliases":["EUVD-2023-49501","GHSA-h49v-gcm2-4fm3"],"status":"published","title":"Use of default credentials vulnerability in MR-GM2 firmware Ver. 3.00.03 and earlier, and MR-GM3 ...","description":"Use of default credentials vulnerability in MR-GM2 firmware Ver. 3.00.03 and earlier, and MR-GM3 (-D/-K/-S/-DK/-DKS/-M/-W) firmware Ver. 1.03.45 and earlier allows a network-adjacent unauthenticated attacker to intercept wireless LAN communication, when the affected product performs the communication without changing the pre-shared key from the factory-default configuration.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00256,"percentile":0.17331,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-798"],"published":"2023-10-11T00:12:54Z","modified":"2026-06-17T06:28:25Z","products":[{"vendor":"micro research ltd.","product":"mr-gm2"},{"vendor":"micro research ltd.","product":"mr-gm3 (-d/-k/-s/-dk/-dks/-m/-w)"},{"vendor":"mrl","product":"mr-gm2_firmware"},{"vendor":"mrl","product":"mr-gm3-d_firmware"},{"vendor":"mrl","product":"mr-gm3-dks_firmware"},{"vendor":"mrl","product":"mr-gm3-k_firmware"},{"vendor":"mrl","product":"mr-gm3-m_firmware"},{"vendor":"mrl","product":"mr-gm3-s_firmware"},{"vendor":"mrl","product":"mr-gm3-w_firmware"}],"references":[{"url":"https://www.mrl.co.jp/20231005_security/","tags":["x_transferred","Patch","Vendor Advisory"]},{"url":"https://jvn.jp/en/vu/JVNVU99039725/","tags":["x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45194"},{"url":"https://jvn.jp/en/vu/JVNVU99039725"},{"url":"https://www.mrl.co.jp/20231005_security"},{"url":"https://github.com/advisories/GHSA-h49v-gcm2-4fm3"}],"sources":{"cve":[{"id":"CVE-2023-45194","description":"Use of default credentials vulnerability in MR-GM2 firmware Ver. 3.00.03 and earlier, and MR-GM3 (-D/-K/-S/-DK/-DKS/-M/-W) firmware Ver. 1.03.45 and earlier allows a network-adjacent unauthenticated attacker to intercept wireless LAN communication, when the affected product performs the communication without changing the pre-shared key from the factory-default configuration.","status":"published","published":"2023-10-11T00:12:54.32Z","modified":"2024-09-18T18:12:54.973Z","updated_at":"2026-11-02T14:35:22.984825Z"}],"euvd":[{"id":"EUVD-2023-49501","description":"Use of default credentials vulnerability in MR-GM2 firmware Ver. 3.00.03 and earlier, and MR-GM3 (-D/-K/-S/-DK/-DKS/-M/-W) firmware Ver. 1.03.45 and earlier allows a network-adjacent unauthenticated attacker to intercept wireless LAN communication, when the affected product performs the communication without changing the pre-shared key from the factory-default configuration.","status":"published","published":"2023-10-11T00:12:54Z","modified":"2024-09-18T18:12:54Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"none"}],"updated_at":"2026-11-03T00:28:20.565617Z"}],"ghsa":[{"id":"GHSA-h49v-gcm2-4fm3","title":"Use of default credentials vulnerability in MR-GM2 firmware Ver. 3.00.03 and earlier, and MR-GM3 ...","description":"Use of default credentials vulnerability in MR-GM2 firmware Ver. 3.00.03 and earlier, and MR-GM3 (-D/-K/-S/-DK/-DKS/-M/-W) firmware Ver. 1.03.45 and earlier allows a network-adjacent unauthenticated attacker to intercept wireless LAN communication, when the affected product performs the communication without changing the pre-shared key from the factory-default configuration.","status":"published","published":"2023-10-11T03:30:32Z","modified":"2024-04-04T08:33:12Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:56:59.092045Z"}],"nvd":[{"id":"CVE-2023-45194","description":"Use of default credentials vulnerability in MR-GM2 firmware Ver. 3.00.03 and earlier, and MR-GM3 (-D/-K/-S/-DK/-DKS/-M/-W) firmware Ver. 1.03.45 and earlier allows a network-adjacent unauthenticated attacker to intercept wireless LAN communication, when the affected product performs the communication without changing the pre-shared key from the factory-default configuration.","status":"published","published":"2023-10-11T01:15:08.837Z","modified":"2026-06-17T06:28:25.39Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:08:36.656095Z"}]}}