CVE-2023-4299
Digi Realport ≤ 1.9-40
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-4299 is a critical-severity Use of Password Hash Instead of Password for Authentication (CWE-836) vulnerability in Digi Realport. Its CVSS base score is 9.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Pass the Hash (T1550.002); ranked in the top 49% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-54170
Vulnerability Data
Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Proper authentication mechanisms require passwords (not pre-hashed values) to be supplied by the claimant and verified server-side.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Directly requires secure handling and protection of authentication credentials, preventing storage or comparison of password hashes as if they were passwords.
Requires proper cryptographic practices for protecting passwords, indirectly mitigating misuse of hashes in authentication.
Secure coding guidance can prevent this implementation error but does not address the control's broader intent.
A.8.5 chooses and strengthens authentication techniques (including MFA, log-on hardening, and brute-force protection) but never addresses storing or comparing a password hash in place of the actual password; the weakness can still be present and exploitable when the control is fully met.