CVE-2023-24049
Connectize Ac21000 G6 Firmware 641.139.1.1256
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-24049 is a critical-severity Weak Password Requirements (CWE-521) vulnerability in Connectize Ac21000 G6 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Brute Force (T1110); ranked in the top 47% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-28113
Vulnerability Data
An issue was discovered on Connectize AC21000 G6 641.139.1.1256 allows attackers to gain escalated privileges on the device via poor credential management.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 2 hardening rules · 1 OS baseline
V6.2.4V6.2.12V6.4.1
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Ensuring authenticators have sufficient strength of mechanism for intended use addresses weak password requirements.
Configuration settings can define and enforce strong password requirements to avoid weak policies.
IA policy establishes password requirements, directly addressing weak password requirements.
Requires authentication that meets guidelines, avoiding default passwords for cryptographic module access.
Organization-wide password and authentication policies are applied uniformly, preventing weak local password requirements.
Facilitated training and awareness of current practices improves definition and enforcement of sufficiently strong password requirements.
Threat awareness programs disseminate botnet and scanning activity tied to default passwords, driving organizations to change or enforce non-default credentials before mass exploitation occurs.
Dedicated security resources support deployment of strong authentication systems and enforcement of robust password policies.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Vulnerability scanning will discover default-password instances, enabling remediation, yet does not itself prevent their initial use.
Credential management directly requires replacing default passwords with unique, strong credentials.
Explicitly requires enforcing minimum password strength as part of authentication.
Authorization policies assume credentials already exist and are not default; least-privilege helps limit impact but does not prevent defaults.
Hardened configuration baselines explicitly prohibit default passwords, covering most of the weakness but not all identity-management aspects.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Enforcing minimum length, complexity, non-dictionary, and non-reuse rules directly counters weak password policies that allow attackers to guess or brute-force credentials.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).
RHEL 7 (2 rules)
- V-204424 The Red Hat Enterprise Linux operating system must not allow accounts configured with blank or null passwords. blocks CWE-521
- V-204425 The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow authentication using an empty password. blocks CWE-521